CVE-2026-62865

Name of the Vulnerable Software and Affected Versions Typebot versions prior to 3.18.0

Description The server-side Send Email integration block allows arbitrary reading of local files on the server. The issue occurs because the parseAttachments helper returns a supplied value as a filesystem path if it does not start with the application's base URL, rather than enforcing an http or https URL. Since the Nodemailer transport is initialized without disableFileAccess or disableUrlAccess enabled, an absolute server path provided via a typebot variable is read from the local filesystem and sent as an attachment. A registered user can exploit this by publishing a bot that attaches sensitive files, such as /etc/passwd or /proc/self/environ, and sends them to a controlled email address. This allows the retrieval of process environment secrets, including the database connection string and credential encryption key, without requiring administrative privileges or victim interaction.

Recommendations Update to version 3.18.0.