CVE-2026-62865
Gravedad CVSS v4.0:
ALTA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
25/08/2026
Última modificación:
26/08/2026
Descripción
*** Pendiente de traducción *** Typebot is an open-source chatbot builder. In self-hosted versions prior to 3.18.0, the server-side Send Email integration block allows arbitrary reading of local files on the server. The block builds Nodemailer attachments from a typebot variable, and its parseAttachments helper returns the supplied value as a filesystem path whenever it does not start with the application's own base URL, instead of requiring an http or https URL. The Nodemailer transport is created without disableFileAccess or disableUrlAccess, both of which default to false, so an attachment specified as an absolute server path is read from the local filesystem and delivered. Because both the attachment value and the recipient list are attacker-controllable typebot variables, any registered user can publish a bot whose Send Email block attaches an absolute path such as /etc/passwd or /proc/self/environ and mails it to an address they control. This enables reading any file the server process can access, including process environment secrets such as the credential encryption key and database connection string, without administrative privileges or victim interaction. Open signup is enabled by default and the system SMTP credential is already configured, so no non-default configuration is required. This issue is fixed in version 3.18.0.
Impacto
Puntuación base 4.0
8.70
Gravedad 4.0
ALTA
Referencias a soluciones, herramientas e información
- https://github.com/baptisteArno/typebot.io/commit/9c81300e5abb28a68a5af2920b92043e3512899d
- https://github.com/baptisteArno/typebot.io/releases/tag/v3.18.0
- https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-j32h-2r6x-wmf3
- https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-j32h-2r6x-wmf3