CVE-2026-30240: Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.5 and earlier, a path traversal vulnerability in the PWA (Progressive Web App) ZIP processing endpoint (POST /api/pwa/process-zip) allows an authenticated user with builder privileges to read arbitrary files from the server filesystem, including /proc/1/environ which contains all environment variables — JWT secrets, database credentials, encryption keys, and API tokens. The server reads attacker-specified files via unsanitized path.join() with user-controlled input from icons.json inside the uploaded ZIP, then uploads the file contents to the object store (MinIO/S3) where they can be retrieved through signed URLs. This results in complete platform compromise as all cryptographic secrets and service credentials are exfiltrated in a single request.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30240?
CVE-2026-30240 is considered a high severity vulnerability due to its potential to expose sensitive server files.
How do I fix CVE-2026-30240?
To fix CVE-2026-30240, you should upgrade Budibase to version 3.31.6 or later, which addresses the path traversal vulnerability.
What is a path traversal vulnerability in CVE-2026-30240?
A path traversal vulnerability in CVE-2026-30240 allows an attacker to manipulate file paths to access arbitrary files on the server.
What kind of data could be exposed by CVE-2026-30240?
CVE-2026-30240 may allow attackers to read sensitive environment secrets and other critical server files.
In which versions of Budibase is CVE-2026-30240 present?
CVE-2026-30240 is present in Budibase versions 3.31.5 and earlier.