CVE-2026-100682GHSA-37r6-5jxh-vm83
Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink
budibase server
CVSS
8.7HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 30 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.57%Chance of exploitation activity in the next 30 days, higher than 46% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.45.0serverCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entries to write arbitrary files as root, enabling remote code execution.
Text from CVE List
Affected versions 2
- serveraffected: all versions before 3.45.0CVE List
- serverunaffected: 3.45.0CVE List