File Access Vulnerability in Typebot Chatbot Builder by Baptiste Arno

CVE-2026-62865

What is CVE-2026-62865?

Typebot, an open-source chatbot builder, has a vulnerability in self-hosted versions prior to 3.18.0 that allows for arbitrary reading of local server files. Specifically, the Send Email integration block improperly constructs Nodemailer attachments from a typebot variable. This issue arises because the parseAttachments helper permits any file path that doesn't start with the application’s base URL, hence allowing attackers to specify absolute paths to sensitive files on the server. With both the attachment value and the recipient list being controlled by users, a registered user can create a bot whose Send Email block attaches files such as /etc/passwd or /proc/self/environ and sends them to an external address. This flaw poses significant risks, enabling the reading of confidential data, including environment secrets and database connection strings, without requiring administrative privileges or interaction from victims. The vulnerability is resolved in version 3.18.0.

References