Budibase arbitrary file existence and read oracle in MongoDB integration

Executive brief

Budibase is a low-code platform used to build business applications. A vulnerability in its MongoDB connector allows users with 'builder' permissions to probe the underlying server's filesystem. This could allow an attacker to confirm the existence of sensitive system files or potentially exfiltrate certificate data, leading to a breach of confidentiality on multi-tenant infrastructure.

Technical details

The vulnerability exists in `packages/server/src/integrations/mongodb.ts` where the `tlsCertificateKeyFile` and `tlsCAFile` configuration fields are passed directly to the MongoDB driver as filesystem paths without validation. An attacker with builder privileges can provide absolute paths or traversal sequences to these fields. When the datasource is verified via the `/api/datasources/verify` endpoint, the server attempts to read the file; the resulting error messages distinguish between files that exist (PEM parsing error) and those that do not (ENOENT), creating a filesystem oracle. In some scenarios, file content could be exfiltrated via mutual TLS to a malicious MongoDB server. The issue is addressed in version 3.40.0.

Affected products

• Budibase Budibase <= 3.38.1

Timeline

• 2026-07-22: disclosed
• 2026-07-24: advisory
• 2026-07-24: patched: Fixed in version 3.40.0

References

• https://api.github.com/users/Hasinohacker
• https://github.com/Hasinohacker
• https://api.github.com/users/Hasinohacker/gists%7B/gist_id%7D
• https://api.github.com/users/Hasinohacker/repos
• https://avatars.githubusercontent.com/u/161377000?v=4
• https://api.github.com/users/Hasinohacker/events%7B/privacy%7D