CVE-2026-100682: Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink
Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entries to write arbitrary files as root, enabling remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibase Serverto a version that resolves this vulnerability.Fixed in 3.45.0
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs network access to the Budibase Server and credentials with the BUILDER role. No user interaction is required.
Which deployments are affected?
Budibase Server versions before 3.45.0 are affected. The vulnerable functionality is the PWA icon upload endpoint that accepts ZIP archives.
What is the impact of successful exploitation?
A BUILDER-role attacker can use crafted ZIP symlink and duplicate-file entries to write arbitrary files as root. This can lead to remote code execution with root-level impact.
How can teams identify attempted exploitation?
Review activity involving PWA icon uploads, particularly ZIP archives containing symlink entries or duplicate file paths. The provided information does not specify file paths, log indicators, or other definitive compromise artifacts.