Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2026-100682: Budibase Server lets attackers write files and run code
CVE-2026-100682 · published 15 days ago
Summary
Versions of Budibase Server before 3.45.0 let someone with a builder role upload a specially crafted ZIP file that can place files anywhere on the system. This can lead to the attacker executing their own code on the server. Upgrade to version 3.45.0 or later to fix the issue and limit upload privileges to trusted users.
What to do
- Update budibase server to version 3.45.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| budibase | server | < 3.45.0 |
Original advisory text
Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink
Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entries to write arbitrary files as root, enabling remote code execution.
References
- https://github.com/Budibase/budibase/security/advisories/GHSA-37r6-5jxh-vm83
- https://www.vulncheck.com/advisories/budibase-server-before-3.45.0-arbitrary-fil...
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-1006... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-100682 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.7
High
Type
CWE-22Path Traversal
Timeline
Published26 Sep 2026
Updated11 Oct 2026
First seen26 Sep 2026
Sources
CVE-2026-100682 · NVD
CVE-2026-100682 · MITRE
CVE-2026-100682 · OSV
GHSA-37r6-5jxh-vm83 · GHSA
Track software like this
Free during beta