GHSA-ppr4-5f46-j9c6: Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile
(updated )
When creating a MongoDB datasource, Budibase passes the tlsCertificateKeyFile and tlsCAFile fields straight to the MongoDB driver as server-side file paths. On Budibase Cloud a customer cannot place files on the server, so these fields only let a builder reference arbitrary absolute paths on the underlying multi-tenant server. When the datasource is verified, the driver performs a real filesystem read of that path, and the error differs by file state, turning /api/datasources/verify into an arbitrary-path existence/read oracle over the whole server filesystem.
References
- github.com/Budibase/budibase/commit/5e19b935536d6d1be1f47100e43c6fb30917826e
- github.com/Budibase/budibase/pull/19244
- github.com/Budibase/budibase/releases/tag/3.40.0
- github.com/Budibase/budibase/security/advisories/GHSA-ppr4-5f46-j9c6
- github.com/advisories/GHSA-ppr4-5f46-j9c6
- nvd.nist.gov/vuln/detail/CVE-2026-73409
Code Behaviors & Features
Detect and mitigate GHSA-ppr4-5f46-j9c6 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →