CVE-2026-100680: Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import
Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to read arbitrary local files. Attackers with builder access can embed file:// references in OpenAPI specifications submitted to the import endpoint to exfiltrate sensitive files including environment variables containing JWT secrets, API keys, and database credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibaseto a version that resolves this vulnerability.Fixed in 3.45.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Budibase user with builder access can exploit it. The attacker must be able to submit an OpenAPI or Swagger specification to the import endpoint.
What does an attacker need to include in an import specification?
The specification can contain file:// references. External JSON reference resolution may then retrieve local files and expose their contents to the attacker.
What information could be exposed if the issue is exploited?
Sensitive local files may be read, including environment-variable data containing JWT secrets, API keys, and database credentials.
How can I determine whether an installation is affected?
Budibase versions before 3.45.0 are affected. Installations where authenticated users have builder access and can use the OpenAPI/Swagger import functionality have the relevant exposure path.