The vulnerability allows a user with builder privileges to supply absolute file paths in API requests that are passed unchanged to the MongoDB driver. The driver’s error response reveals whether the file exists and is readable on the shared server, creating a filesystem presence and readability oracle. This information disclosure may enable an attacker to discover sensitive files or internal structure of the server, but it does not directly provide code execution or unauthorized data access.

Budibase platforms prior to version 3.40.1 are affected. Any instance running a Budibase server with a vulnerable version of server/src/integrations/mongodb.ts exposed the verify API endpoint to builder‑controlled input.

The CVSS score of 5.1 indicates moderate severity, and the lack of an EPSS score suggests no known exploit activity at the time of assessment. The vulnerability is not listed in CISA’s KEV catalog. Likely exploitation requires remote access to the Budibase server’s API and building a payload that probes file paths; it is a remote information‑disclosure attack that could be part of a broader reconnaissance effort.