EUVD-2026-18793
GHSA-2wfh-rcwf-wh23
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Budibase is an open-source low-code platform. Prior to version 3.33.4, the plugin file upload endpoint (POST /api/plugin/upload) passes the user-supplied filename directly to createTempFolder() without sanitizing path traversal sequences. An attacker with Global Builder privileges can craft a multipart upload with a filename containing ../ to delete arbitrary directories via rmSync and write arbitrary files via tarball extraction to any filesystem path the Node.js process can access. This issue has been patched in version 3.33.4.
AnalysisAI
Path traversal in Budibase plugin upload endpoint allows Global Builders to delete arbitrary directories and write files to any accessible filesystem path. Affecting all versions prior to 3.33.4, attackers with high privileges (Global Builder role) can exploit unsanitized filename handling in POST /api/plugin/upload to execute directory traversal attacks remotely with low complexity. CVSS 8.7 (High) with scope change indicates potential container escape or cross-tenant impact. No public exploit identified at time of analysis, though the attack vector is straightforward given the documented path traversal mechanism.
Technical ContextAI
Budibase is a Node.js-based open-source low-code application platform. The vulnerability exists in the plugin upload endpoint which accepts multipart file uploads for extending platform functionality. The affected code path calls createTempFolder() with unsanitized user input from the filename parameter, then performs filesystem operations including rmSync (recursive directory deletion) and tarball extraction. This represents a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) vulnerability. The Node.js fs module operations combined with path traversal sequences (../) allow breaking out of intended directory constraints. The 'Changed' scope in CVSS indicates the vulnerability can affect resources beyond the vulnerable component's security scope, suggesting potential impact on the underlying host system or other tenant data in multi-tenant deployments.
RemediationAI
Upgrade to Budibase version 3.33.4 or later, which implements proper filename sanitization in the plugin upload endpoint as documented in release https://github.com/Budibase/budibase/releases/tag/3.33.4. The fix implemented in commit 6344d06d703660fd05995e61d581593c2349c879 and merged via pull request https://github.com/Budibase/budibase/pull/18240 adds path traversal sequence validation before filesystem operations. Organizations unable to immediately upgrade should implement compensating controls including restricting Global Builder role assignment to only essential administrators, monitoring plugin upload activity for suspicious filenames containing traversal sequences, implementing filesystem-level access controls to limit Node.js process permissions, and considering disabling plugin upload functionality if not operationally required. Review audit logs for POST requests to /api/plugin/upload with unusual filename patterns as potential indicators of exploitation attempts.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today