Executive brief
Budibase is a low-code application platform that allows builders to create datasources by configuring connections to databases. A vulnerability in the MongoDB datasource configuration allows a builder to supply arbitrary file paths, which the server reads when verifying the connection. By observing different error messages, an attacker can determine whether files exist anywhere on the underlying server filesystem and exfiltrate their contents—potentially accessing secrets, configuration files, and other tenants' data on multi-tenant Budibase Cloud instances.
Technical details
The vulnerability is an information disclosure (CWE-209) in packages/server/src/integrations/mongodb.ts. The MongoDB integration passes user-controlled tlsCertificateKeyFile and tlsCAFile configuration fields directly to the MongoDB driver as filesystem paths without validation, filtering, or directory confinement. When a datasource is verified via /api/datasources/verify, the MongoDB driver performs a real filesystem read of the attacker-supplied path. Files that exist but are not valid PEM return a "PEM routines" error; non-existent files return "ENOENT" with the path reflected. This creates a filesystem existence/read oracle. The attack requires authentication as a builder (local attack vector with user interaction to create/verify a datasource). Patches are available in version 3.40.0 and later, implementing PEM-from-content and path restrictions.
Affected products
- Budibase Budibase <3.40.0
Timeline
- 2026-07-24: disclosed
- 2026-07-24: patched: Fixed in version 3.40.0