CVE-2026-100682: Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-26 · updated 2026-10-08
Weakness: CWE-22

Description

Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entries to write arbitrary files as root, enabling remote code execution.

Affected products

budibase server: before 3.45.0 — fixed in 3.45.0

How to fix

Upgrade to a fixed version: budibase server 3.45.0. Check the vendor advisory for mitigations.

References

https://github.com/Budibase/budibase/security/advisories/GHSA-37r6-5jxh-vm83
https://www.vulncheck.com/advisories/budibase-server-before-3.45.0-arbitrary-file-write-via-zip-symlink
https://github.com/Budibase/budibase/security/advisories/GHSA-37r6-5jxh-vm83

Get alerted when CVE-2026-100682 or the next vulnerability affects your stack