Skip to main content

Budibase EUVDEUVD-2026-58501

| CVE-2026-72850 CRITICAL
Path Traversal (CWE-22)
2026-08-13 disclosure@vulncheck.com GHSA-ccjw-whgg-h4gh
Path Traversal
9.4
CVSS 4.0 · Vendor: vulncheck
Share

Severity by source

Vendor (vulncheck) PRIMARY
9.4 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.1 CRITICAL

Network-reachable and low-complexity, but requires builder-role privileges (PR:H); arbitrary write outside the process sandbox justifies scope change (S:C) with high C/I/A via code execution.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 13, 2026 - 23:04 EUVD
Analysis Generated
Aug 13, 2026 - 22:34 vuln.today
CVE Published
Aug 13, 2026 - 22:17 cve.org
CRITICAL 9.4

DescriptionCVE.org

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .. segments that escape the temporary directory during workspace export, writing arbitrary content to any path writable by the Budibase process.

AnalysisAI

Arbitrary file write in Budibase before 3.40.0 allows authenticated users holding the builder role to plant files with path-traversal sequences that survive the workspace export process, letting them write attacker-controlled content to any location writable by the Budibase server process. The flaw stems from unsanitized S3 object keys whose .. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate as Budibase builder
Delivery
Upload file with `..` traversal in S3 key
Exploit
Trigger workspace export
Execution
Traversal escapes temp directory
Persist
Write payload to writable system path
Impact
Achieve code execution or config tampering
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an authenticated account with the Budibase builder role (CVSS PR:H) and the ability to invoke the workspace export feature, which is the exact code path that reconstructs files from S3 object keys. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N with VC/VI/VA:H and subsequent-system SC/SI/SA:H) scores 9.4, driven by network reachability, low complexity, and high impact including cross-system consequences, but the PR:H metric is the key limiter - an attacker must already hold builder-level privileges, so this is a privilege-escalation / trusted-insider or post-compromise scenario rather than a pre-auth internet worm. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained or been granted a Budibase builder account uploads an asset whose S3 object key embeds `../../` traversal segments, then triggers a workspace export; when the server materializes the export, the crafted key resolves outside the temporary directory and writes attacker-controlled content to a sensitive location such as a cron job or web-accessible directory, yielding code execution as the Budibase process. No public proof-of-concept is known, but the attack is low-complexity over the network once builder access is held.
Remediation Vendor-released patch: 3.40.0 - upgrade all Budibase instances to 3.40.0 or later, which sanitizes S3 object keys so traversal sequences no longer survive export, per GHSA-pxwc-66g3-5f27 (https://github.com/Budibase/budibase/security/advisories/GHSA-pxwc-66g3-5f27) and the VulnCheck advisory (https://www.vulncheck.com/advisories/budibase-before-arbitrary-file-write-via-path-traversal). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: audit and inventory all builder-role users in Budibase, revoke access for non-essential accounts, and disable the workspace export feature if not operationally required. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Share

EUVD-2026-58501 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy