CVE-2026-62865: Typebot Information Disclosure Vulnerability

CVE-2026-62865 Overview

CVE-2026-62865 is an arbitrary file read vulnerability in Typebot, an open-source chatbot builder. Self-hosted Typebot deployments prior to version 3.18.0 allow any registered user to exfiltrate arbitrary files from the server through the Send Email integration block. The block accepts attacker-controlled variables as attachment paths and reads them directly from the local filesystem when the value does not begin with the application base URL. Because open signup is enabled by default and the system SMTP credential ships preconfigured, no non-default settings are required to trigger the flaw. The issue is fixed in Typebot version 3.18.0.

Critical Impact
Attackers can read any file the Typebot server process can access, including /etc/passwd, /proc/self/environ, database connection strings, and the credential encryption key, without administrative privileges or victim interaction.

Affected Products

Typebot self-hosted versions prior to 3.18.0
Typebot Send Email integration block (executeSendEmailBlock.tsx)
Deployments with default open signup and system SMTP configured

Discovery Timeline

2026-08-25 - CVE-2026-62865 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-62865

Vulnerability Analysis

The vulnerability resides in the Send Email integration block within the Typebot bot engine. The parseAttachments helper inspects each attachment value supplied through a typebot variable. When the value does not start with the application's own base URL, the helper returns it as a filesystem path rather than requiring an http or https scheme. Nodemailer then reads that path from disk and includes the file contents in the outgoing message.

The Nodemailer transport is instantiated without setting disableFileAccess or disableUrlAccess, both of which default to false. This preserves Nodemailer's ability to open local files referenced by absolute paths. Combined with attacker control over both the attachment value and the recipient list, this produces a reliable primitive for exfiltrating arbitrary server-side files (classified as [CWE-73]: External Control of File Name or Path).

Root Cause

The root cause is missing scheme validation in parseAttachments and insecure Nodemailer defaults. The helper treats any non-URL string as a valid local filesystem path instead of rejecting or normalizing it. Because Typebot enables open user registration and preconfigures SMTP credentials by default, an unauthenticated attacker only needs to sign up to reach the vulnerable code path.

Attack Vector

An attacker registers an account, builds a bot containing a Send Email block, and sets the attachment variable to an absolute server path such as /etc/passwd or /proc/self/environ. The recipient is set to a mailbox the attacker controls. Publishing and executing the bot causes the server to read the referenced file and deliver its contents to the attacker over SMTP. Sensitive targets include the process environment, which typically contains the credential encryption key and database connection string.

text

// Patch: packages/bot-engine/src/blocks/integrations/sendEmail/executeSendEmailBlock.tsx
 import { renderDefaultBotNotificationEmail } from "@typebot.io/emails/transactional/DefaultBotNotificationEmail";
 import { env } from "@typebot.io/env";
 import { parseUnknownError } from "@typebot.io/lib/parseUnknownError";
-import { getFileTempUrl } from "@typebot.io/lib/s3/getFileTempUrl";
 import {
   byId,
   isDefined,

Source: GitHub commit 9c81300

Detection Methods for CVE-2026-62865

Indicators of Compromise

Outbound SMTP messages sent by the Typebot server process with attachments whose names resemble absolute filesystem paths such as passwd, environ, or .env.
New user registrations followed shortly by creation and publication of a bot containing a Send Email block.
Send Email block executions where the attachment variable resolves to a value not beginning with http:// or https://.

Detection Strategies

Review Typebot application logs for Send Email block invocations and correlate attachment variable values against expected URL patterns.
Inspect SMTP relay logs for messages originating from the Typebot host containing attachments matching sensitive filenames.
Audit filesystem access by the Typebot Node.js process for reads of /etc/passwd, /proc/self/environ, /proc/*/environ, and configuration files outside the application directory.

Monitoring Recommendations

Enable process-level file access auditing on Typebot hosts using auditd rules that watch sensitive paths.
Forward Typebot application and SMTP transport logs to a centralized logging platform for correlation and retention.
Alert on anomalous Send Email volumes or attachments delivered to external, non-corporate mail domains.

How to Mitigate CVE-2026-62865

Immediate Actions Required

Upgrade all self-hosted Typebot deployments to version 3.18.0 or later.
Rotate the credential encryption key, database credentials, SMTP credentials, and any secrets exposed via process environment variables.
Disable open signup and review recently registered accounts and published bots for Send Email blocks referencing suspicious attachment values.

Patch Information

The fix is available in Typebot 3.18.0. Details are documented in the GitHub Security Advisory GHSA-j32h-2r6x-wmf3 and released in the GitHub Release v3.18.0. The underlying code changes are in GitHub commit 9c81300, which corrects attachment handling in executeSendEmailBlock.tsx.

Workarounds

If patching cannot be performed immediately, disable the Send Email integration block or remove SMTP credentials from the Typebot configuration.
Set NEXT_PUBLIC_DISABLE_SIGNUP (or equivalent) to disable open user registration until the upgrade is complete.
Restrict Typebot process filesystem access using container read-only mounts, AppArmor, or SELinux policies that block reads outside the application directory.

bash

# Upgrade self-hosted Typebot to the fixed release
docker pull baptistearno/typebot-builder:3.18.0
docker pull baptistearno/typebot-viewer:3.18.0

# Verify running version
docker inspect --format '{{.Config.Image}}' typebot-builder

# Disable open signup until upgraded (example environment variable)
export DISABLE_SIGNUP=true