Arbitrary file write via S3 key path traversal in Budibase (CVE-2026-72850)

Budibase's `sanitizeKey` helper preserves `..` segments in S3 object keys because the underlying `sanitize-s3-objectkey@0.0.1` library does not strip them. An authenticated user with builder or admin permissions can upload files whose names contain path traversal sequences; when a workspace is subsequently exported, `retrieveDirectory` writes each object's body to the filesystem using `path.join`, which resolves the `..` segments and places attacker-controlled content at arbitrary paths writable by the Budibase process - including `/tmp/`, `/etc/cron.d/`, and `~/.ssh/`. Affected versions: - master at commit 3c8d1b4023 We recommend updating to: 3.40.0. CVSS 9.4 · our assessment: act_now Reference: https://github.com/Budibase/budibase/security/advisories/GHSA-pxwc-66g3-5f27 Details: https://vuln.today/cve/CVE-2026-72850