Executive brief
Typebot is an open-source chatbot builder that allows users to create conversational applications. In self-hosted versions prior to 3.18.0, attackers can exploit the Send Email integration block to read arbitrary files from the server—such as configuration files, environment variables containing database credentials, and encryption keys—by simply publishing a malicious bot without needing admin access or victim interaction. This exposes sensitive system information and secrets that could compromise the entire application and underlying infrastructure.
Technical details
The vulnerability is a local file read in the Send Email integration block caused by insecure attachment handling. The parseAttachments helper treats any non-HTTP URL as a filesystem path and passes it directly to Nodemailer without enabling file access restrictions (disableFileAccess and disableUrlAccess both default to false). An attacker can create a typebot with a Send Email block that attaches an absolute path like /etc/passwd or /proc/self/environ, then trigger the block to send the file to an attacker-controlled email address. Since both the attachment path and recipient email are typebot variables under attacker control, and open signup is enabled by default, no authentication or administrative privileges are required. The fix in version 3.18.0 restricts attachments to valid Typebot upload URLs, enables Nodemailer file access protection, and requires short-lived storage URLs for private uploads.
Affected products
- Typebot Typebot prior to 3.18.0
Timeline
- 2026-08-25: disclosed
- 2026-06-27: patched: Fix commit merged; version 3.18.0 released 2026-08-21