CVE-2026-62865
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Typebot in self-hosted versions prior to 3.18.0 has a vulnerability in the Send Email integration block that allows arbitrary reading of local files on the server. The block builds Nodemailer attachments from typebot variables, and its parseAttachments helper returns the supplied value as a filesystem path whenever it does not start with the application's own base URL. The Nodemailer transport is created without disabling file access, so an attachment specified as an absolute server path is read from the local filesystem and delivered.
Risk Assessment
A registered user can publish a bot that sends files such as /etc/passwd or /proc/self/environ to an attacker-controlled address, enabling theft of environment secrets including the credential encryption key and database connection string.
Recommendation
Upgrade Typebot to version 3.18.0 or later, which includes a fix preventing local file reads.
Other vulnerabilities in Typebot
See all- CVE-2026-42142High
TypeBot before version 3.17.0 in the `handleGetSheets` API handler does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data. Version 3.17.0 fixes the issue.
- CVE-2025-65098High
Typebot before version 3.13.2 allows client-side script execution that can steal all stored credentials from any user. When a victim previews a malicious typebot, JavaScript executes in their browser and exfiltrates OpenAI keys, Google Sheets tokens, and SMTP passwords. The /api/trpc/credentials.getCredentials endpoint returns plaintext API keys without verifying credential ownership.
- CVE-2026-62862Critical
Typebot up to version 3.17.1 (self-hosted) has a brute-force vulnerability in the default passwordless email magic-link authentication. The code is generated using Math.random() and has only 900,000 possible combinations, with no attempt limits or lockouts, allowing account takeover. An attacker knowing the victim's email address can gain full access without victim interaction.
- CVE-2026-48765Critical
TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth `credentialsId` from a readable bot configuration and then overwrite that credential through `handleUpdateOAuthCredentials()` by supplying an attacker-controlled writable `workspaceId`. The update path validates only the attacker-supplied workspace and then updates the credential record by global `id` alone, while also rewriting the credential's `workspaceId`. This allows cross-workspace OAuth credential takeover and reassignment. Version 3.17.0 patches the issue.
- CVE-2026-47705Critical
TypeBot version 3.16.1 has a CSV injection vulnerability in the result export functionality. The application does not sanitize or escape user-supplied input when generating CSV files. An attacker can inject spreadsheet formulas into input fields, which are later executed when an administrator opens the exported CSV in spreadsheet software such as Microsoft Excel or LibreOffice Calc. Version 3.17.0 patches the issue.
- CVE-2026-47702Critical
TypeBot version 3.16.1 stores API tokens in the database as cleartext. An attacker with database read access can extract all tokens and impersonate any user without password or MFA.
- CVE-2026-48768Critical
TypeBot is a chatbot builder tool that in versions 3.16.1 and earlier has an unauthenticated endpoint for generating upload URLs. This allows anonymous users to upload malicious HTML, SVG, or JS files, potentially leading to stored XSS.
- CVE-2026-10731Critical
SQL injection in the 'two_steps_auth_code' parameter processed by the 'twoStepsAuthVerification' function in the '/user-login' endpoint. The 2FA functionality is accessible without authentication, allowing unauthenticated attackers to execute arbitrary SQL queries. Successful exploit can lead to database enumeration, unauthorized creation of privileged users, modification or deletion of critical information, and denial of service.
- CVE-2026-33712Critical
Typebot versions 3.15.2 and prior have an SSRF vulnerability in the preview chat endpoint. An unauthenticated attacker can supply a custom typebot definition with server-side code, bypassing SSRF validation and making network requests from the server.
- CVE-2025-64709Critical
Typebot, an open-source chatbot builder, in versions prior to 3.13.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the webhook block (HTTP Request component). Authenticated users can make arbitrary HTTP requests from the server, including access to AWS Instance Metadata Service (IMDS). By bypassing IMDSv2 protection through custom header injection, attackers can extract temporary AWS IAM credentials for the EKS node role, leading to complete compromise of the Kubernetes cluster and associated AWS infrastructure. Version 3.13.1 fixes the issue.
Original NVD description (English source)
Typebot is an open-source chatbot builder. In self-hosted versions prior to 3.18.0, the server-side Send Email integration block allows arbitrary reading of local files on the server. The block builds Nodemailer attachments from a typebot variable, and its parseAttachments helper returns the supplied value as a filesystem path whenever it does not start with the application's own base URL, instead of requiring an http or https URL. The Nodemailer transport is created without disableFileAccess or disableUrlAccess, both of which default to false, so an attachment specified as an absolute server path is read from the local filesystem and delivered. Because both the attachment value and the recipient list are attacker-controllable typebot variables, any registered user can publish a bot whose Send Email block attaches an absolute path such as /etc/passwd or /proc/self/environ and mails it to an address they control. This enables reading any file the server process can access, including process environment secrets such as the credential encryption key and database connection string, without administrative privileges or victim interaction. Open signup is enabled by default and the system SMTP credential is already configured, so no non-default configuration is required. This issue is fixed in version 3.18.0.