The send‑email block of the open‑source chatbot builder accepts a variable to build Nodemailer attachments. Its helper returns the provided value as a filesystem path whenever it does not start with the application’s own base URL, instead of requiring an HTTP or HTTPS URL. When the Nodemailer transport is created without disabling file or URL access (both defaults are false), an attachment that uses an absolute server path is read from the local filesystem and transmitted. Because the attachment value and the recipient list are attacker‑controllable variables, an attacker can cause the system to read any file the server process can access, including sensitive environment secrets and configuration files such as the credential encryption key and database connection string.

Typebot.io, the self‑hosted chatbot platform developed by baptisteArno, is affected. All versions prior to 3.18.0 are vulnerable. The flaw exists in the server‑side Send‑Email integration block and can be triggered by any registered user without requiring administrative privileges or special configuration.

The vulnerability carries a CVSS score of 8.7 and is not listed in the CISA KEV catalog. EPSS data is unavailable, but no configuration changes or privileged access are needed; the default system SMTP credential is already configured and open signup is enabled by default. The likely attack vector is a registered user creating a bot that specifies an absolute path such as /etc/passwd or /proc/self/environ for an attachment and mailing it to an address they control, thereby exfiltrating the server’s file contents. Given the high severity score and the ease of exploitation, the risk warrants urgent attention.