GHSA-ppr4-5f46-j9c6: Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile
(updated )
When creating a MongoDB datasource, Budibase passes the tlsCertificateKeyFile and tlsCAFile fields straight to the MongoDB driver as server-side file paths. On Budibase Cloud a customer cannot place files on the server, so these fields only let a builder reference arbitrary absolute paths on the underlying multi-tenant server. When the datasource is verified, the driver performs a real filesystem read of that path, and the error differs by file state, turning /api/datasources/verify into an arbitrary-path existence/read oracle over the whole server filesystem.
References
- github.com/Budibase/budibase/commit/5e19b935536d6d1be1f47100e43c6fb30917826e
- github.com/Budibase/budibase/pull/19244
- github.com/Budibase/budibase/releases/tag/3.40.0
- github.com/Budibase/budibase/security/advisories/GHSA-ppr4-5f46-j9c6
- github.com/advisories/GHSA-ppr4-5f46-j9c6
- nvd.nist.gov/vuln/detail/CVE-2026-73409
Code Behaviors & Features
Detect and mitigate GHSA-ppr4-5f46-j9c6 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →