{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"3.38.1"}],"component":"@budibase/server","cve_ids":["CVE-2026-73409"],"ecosystem":"npm","epss":0.00319,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-ppr4-5f46-j9c6","id":"tcs_01M5KG45W0MT4M9422J78PASSP","modified_at":"2026-08-12T19:40:58.830104Z","published_at":"2026-07-24T21:16:41Z","references":["https://osv.dev/vulnerability/GHSA-ppr4-5f46-j9c6","https://github.com/Budibase/budibase/security/advisories/GHSA-ppr4-5f46-j9c6","https://github.com/Budibase/budibase/pull/19244","https://github.com/Budibase/budibase/commit/5e19b935536d6d1be1f47100e43c6fb30917826e","https://github.com/Budibase/budibase","https://github.com/Budibase/budibase/releases/tag/3.40.0"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-ppr4-5f46-j9c6","url":"https://osv.dev/vulnerability/GHSA-ppr4-5f46-j9c6"}],"summary":"Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile"}