An information exposure and path traversal vulnerability in Typebot allows unauthenticated attackers to access sensitive system information, posing a critical risk to data confidentiality.

This vulnerability involves the exposure of sensitive information to unauthorized actors (CWE-200) and external control of file paths (CWE-73). The issue allows an unauthenticated attacker to manipulate file paths to retrieve information that should remain private.

Unauthorized access to sensitive files can lead to data breaches, including the exposure of configuration files, credentials, or user data. With a CVSS score of 8.7, this vulnerability represents a significant threat to the confidentiality of information stored within the chatbot builder environment.

Immediate Action: Update the Typebot installation to version 3.18.0 or later to patch the underlying path traversal and information exposure flaws.

Proactive Monitoring: Review system access logs for unusual file access patterns or requests containing directory traversal sequences, such as dot-dot-slash patterns.

Compensating Controls: Ensure the application is running with the principle of least privilege, restricting the file system access available to the service user to the minimum required for operation.

Public Exploit Available: Unknown.

The risk of unauthorized information disclosure is high and requires immediate remediation. Organizations should deploy the latest version of Typebot to close this security gap and protect sensitive system assets from potential exfiltration.