What’s Vulnerable › Vulnerabilities

CVE-2026-35214: Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write

• Severity: high (CVSS 8.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-03 · updated 2026-10-06
• Weakness: CWE-22

Description

Budibase is an open-source low-code platform. Prior to version 3.33.4, the plugin file upload endpoint (POST /api/plugin/upload) passes the user-supplied filename directly to createTempFolder() without sanitizing path traversal sequences. An attacker with Global Builder privileges can craft a multipart upload with a filename containing ../ to delete arbitrary directories via rmSync and write arbitrary files via tarball extraction to any filesystem path the Node.js process can access. This issue has been patched in version 3.33.4.

Affected products

• budibase: before 3.33.4 — fixed in 3.33.4

How to fix

Upgrade to a fixed version: budibase 3.33.4. Check the vendor advisory for mitigations.

References

• https://github.com/Budibase/budibase/commit/6344d06d703660fd05995e61d581593c2349c879
• https://github.com/Budibase/budibase/pull/18240
• https://github.com/Budibase/budibase/releases/tag/3.33.4
• https://github.com/Budibase/budibase/security/advisories/GHSA-2wfh-rcwf-wh23
• https://github.com/Budibase/budibase/security/advisories/GHSA-2wfh-rcwf-wh23

Get alerted when CVE-2026-35214 or the next vulnerability affects your stack