CVE-2026-100682 in Server
Summary
by MITRE • 09/26/2026
Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entries to write arbitrary files as root, enabling remote code execution.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/26/2026
The Budibase Server platform prior to version 3.45.0 contains a critical security vulnerability within its Progressive Web Application icon upload functionality that allows for arbitrary file writes and subsequent remote code execution. This flaw is rooted in the server-side processing of ZIP archives submitted through the PWA icon endpoint, where the extraction logic fails to adequately validate symbolic links contained within the archive structure. The vulnerability specifically exploits the behavior of standard ZIP extraction utilities which may follow symlinks during decompression if not explicitly restricted by security controls. By crafting a maliciously constructed ZIP file that includes leaf symlink entries pointing to sensitive system directories or configuration files, an attacker can manipulate the extraction process to write data outside the intended application directory structure.
The technical mechanism of this exploit relies on the specific ordering and composition of entries within the crafted archive. An attacker with BUILDER role privileges creates a ZIP file containing symbolic links that resolve to paths such as /etc/passwd or other writable locations accessible by the root user, followed immediately by duplicate file entries intended for those target paths. When Budibase processes this upload, it extracts the symlinks first and then proceeds to write the subsequent files into them without verifying whether the destination is a legitimate application asset directory. Because the web server process often runs with elevated privileges or has access to root-level directories depending on the deployment configuration, this file write operation succeeds in placing arbitrary content onto the filesystem as the root user.
This capability directly leads to remote code execution under specific conditions where an attacker can place executable scripts or malicious configurations into locations that are subsequently executed by system services or interpreted by application logic. For instance, writing a web shell to a directory served statically or modifying environment configuration files could allow the attacker to gain full control over the underlying host operating system. The impact is severe as it bypasses standard role-based access controls intended for BUILDER users, effectively escalating privileges from a limited development role to root-level administrative access on the server infrastructure. This represents a significant breach of confidentiality and integrity within the Budibase deployment environment.
From an industry standards perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal, combined with CWE-59: Improper Link Resolution Before File Access which describes the failure to validate symbolic links prior to using them in file operations. In terms of attack tactics, this exploitation method corresponds to ATT&CK technique T1059 Command and Scripting Interpreter for executing malicious code after gaining initial access via T1190 Exploit Public-Facing Application. The vulnerability highlights the risks associated with trusting user-supplied archive formats without rigorous sanitization of internal structures like symlinks, which are often overlooked in basic extraction implementations that assume all entries represent regular files.
Mitigation strategies must prioritize immediate upgrading to Budibase version 3.45.0 or later where this issue has been addressed through improved validation logic for symbolic links during archive extraction. Administrators should also implement strict input validation on the PWA icon upload endpoint, ensuring that only expected file types are accepted and that any extracted content is confined strictly within designated asset directories using chroot environments or containerized isolation if possible. Additionally, running application services with the principle of least privilege by avoiding root-level execution can significantly reduce the impact even if such a vulnerability were present in other components. Regular security audits focusing on archive handling libraries and their configuration settings are recommended to prevent similar issues across all file upload mechanisms within the platform.