What is the CVSS score of CVE-2026-35214?

CVE-2026-35214 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Node.js are affected by CVE-2026-35214?

Budibase versions prior to 3.33.4 contain a critical path traversal vulnerability in the plugin upload function that allows privileged users (Global Builders) to delete arbitrary directories and…. A patch is available.

How to fix or mitigate CVE-2026-35214?

Within 24 hours: Identify all Budibase instances and document current versions; audit Global Builder role assignments and restrict to essential personnel only. Within 7 days: Contact Budibase support to confirm ETA for patch 3.33.4 and evaluate temporary air-gapping of plugin upload functionality if available; implement network segmentation to limit Global Builder access to trusted IP ranges. Within 30 days: Upgrade all Budibase instances to version 3.33.4 or later once released; conduct post-upgrade audit of filesystem integrity and validate no unauthorized file writes occurred.

Node.js CVE-2026-35214

EUVD-2026-18793 HIGH

Path Traversal (CWE-22)

2026-04-03 GitHub_M

GHSA-2wfh-rcwf-wh23

Node.js Path Traversal File Upload

8.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 04, 2026 - 08:30 nvd

Patch available

EUVD ID Assigned

Apr 03, 2026 - 16:00 euvd

EUVD-2026-18793

Analysis Generated

Apr 03, 2026 - 16:00 vuln.today

CVE Published

Apr 03, 2026 - 15:43 nvd

HIGH 8.7

DescriptionGitHub Advisory

Budibase is an open-source low-code platform. Prior to version 3.33.4, the plugin file upload endpoint (POST /api/plugin/upload) passes the user-supplied filename directly to createTempFolder() without sanitizing path traversal sequences. An attacker with Global Builder privileges can craft a multipart upload with a filename containing ../ to delete arbitrary directories via rmSync and write arbitrary files via tarball extraction to any filesystem path the Node.js process can access. This issue has been patched in version 3.33.4.

AnalysisAI

Path traversal in Budibase plugin upload endpoint allows Global Builders to delete arbitrary directories and write files to any accessible filesystem path. Affecting all versions prior to 3.33.4, attackers with high privileges (Global Builder role) can exploit unsanitized filename handling in POST /api/plugin/upload to execute directory traversal attacks remotely with low complexity. CVSS 8.7 (High) with scope change indicates potential container escape or cross-tenant impact. No public exploit identified at time of analysis, though the attack vector is straightforward given the documented path traversal mechanism.

Technical ContextAI

Budibase is a Node.js-based open-source low-code application platform. The vulnerability exists in the plugin upload endpoint which accepts multipart file uploads for extending platform functionality. The affected code path calls createTempFolder() with unsanitized user input from the filename parameter, then performs filesystem operations including rmSync (recursive directory deletion) and tarball extraction. This represents a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) vulnerability. The Node.js fs module operations combined with path traversal sequences (../) allow breaking out of intended directory constraints. The 'Changed' scope in CVSS indicates the vulnerability can affect resources beyond the vulnerable component's security scope, suggesting potential impact on the underlying host system or other tenant data in multi-tenant deployments.

RemediationAI

Upgrade to Budibase version 3.33.4 or later, which implements proper filename sanitization in the plugin upload endpoint as documented in release https://github.com/Budibase/budibase/releases/tag/3.33.4. The fix implemented in commit 6344d06d703660fd05995e61d581593c2349c879 and merged via pull request https://github.com/Budibase/budibase/pull/18240 adds path traversal sequence validation before filesystem operations. Organizations unable to immediately upgrade should implement compensating controls including restricting Global Builder role assignment to only essential administrators, monitoring plugin upload activity for suspicious filenames containing traversal sequences, implementing filesystem-level access controls to limit Node.js process permissions, and considering disabling plugin upload functionality if not operationally required. Review audit logs for POST requests to /api/plugin/upload with unusual filename patterns as potential indicators of exploitation attempts.