Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.6
Budibase: Attacker can read sensitive server files with malicious ZIP
CVE-2026-30240
Summary
A security bug in Budibase's ZIP processing lets an authorized user with administrative privileges access sensitive server files, including secret keys and database credentials. This puts the entire platform at risk of compromise. Update Budibase to the latest version to fix this issue.
Original title
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.5 and earlier, a path traversal vulnerability in the PWA (Progressive Web App) ZIP processing endpo...
Original description
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.5 and earlier, a path traversal vulnerability in the PWA (Progressive Web App) ZIP processing endpoint (POST /api/pwa/process-zip) allows an authenticated user with builder privileges to read arbitrary files from the server filesystem, including /proc/1/environ which contains all environment variables — JWT secrets, database credentials, encryption keys, and API tokens. The server reads attacker-specified files via unsanitized path.join() with user-controlled input from icons.json inside the uploaded ZIP, then uploads the file contents to the object store (MinIO/S3) where they can be retrieved through signed URLs. This results in complete platform compromise as all cryptographic secrets and service credentials are exfiltrated in a single request.
nvd CVSS3.1
9.6
Vulnerability type
CWE-22
Path Traversal
CWE-73
Published: 9 Mar 2026 · Updated: 13 Mar 2026 · First seen: 9 Mar 2026