CVE-2026-62865: TypeBot: Arbitrary server file read via Send Email block attachment path
Typebot is an open-source chatbot builder. In self-hosted versions prior to 3.18.0, the server-side Send Email integration block allows arbitrary reading of local files on the server. The block builds Nodemailer attachments from a typebot variable, and its parseAttachments helper returns the supplied value as a filesystem path whenever it does not start with the application's own base URL, instead of requiring an http or https URL. The Nodemailer transport is created without disableFileAccess or disableUrlAccess, both of which default to false, so an attachment specified as an absolute server path is read from the local filesystem and delivered. Because both the attachment value and the recipient list are attacker-controllable typebot variables, any registered user can publish a bot whose Send Email block attaches an absolute path such as /etc/passwd or /proc/self/environ and mails it to an address they control. This enables reading any file the server process can access, including process environment secrets such as the credential encryption key and database connection string, without administrative privileges or victim interaction. Open signup is enabled by default and the system SMTP credential is already configured, so no non-default configuration is required. This issue is fixed in version 3.18.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Typebotto a version that resolves this vulnerability.Fixed in 3.18.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Self-hosted Typebot deployments running versions prior to 3.18.0 are affected. Open signup is enabled by default, so a default deployment may allow an untrusted registered user to exploit the issue.
What does an attacker need to exploit this?
The attacker needs only to register an account and publish a bot containing a Send Email block. They can control both the attachment path and recipient through typebot variables, with no administrative privileges or victim interaction required.
What information could be exposed?
An attacker can have the server email files readable by the Typebot server process, including files such as /etc/passwd and /proc/self/environ. This can expose process environment secrets, including the credential encryption key and database connection string.
How can I determine whether exploitation may have occurred?
Review Typebot accounts and published bots for Send Email blocks whose attachment values resolve to absolute local filesystem paths, and review outbound email activity for unexpected recipients or attachments. The provided information does not identify any specific log indicators.
What should be prioritized for remediation?
Upgrade affected self-hosted deployments to version 3.18.0 or later. Until patching is possible, restrict untrusted user registration and access to creating or publishing bots with Send Email blocks, and limit the server process's access to sensitive files and environment secrets where feasible.