CVE-2026-72850: Budibase before 3.40.0 Arbitrary File Write via Path Traversal

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-13 · updated 2026-10-08
Weakness: CWE-22

Description

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .. segments that escape the temporary directory during workspace export, writing arbitrary content to any path writable by the Budibase process.

Affected products

budibase server: before 3.40.0 — fixed in 3.40.0

How to fix

Upgrade to a fixed version: budibase server 3.40.0. Check the vendor advisory for mitigations.

References

https://github.com/Budibase/budibase/security/advisories/GHSA-pxwc-66g3-5f27
https://www.vulncheck.com/advisories/budibase-before-arbitrary-file-write-via-path-traversal
https://github.com/Budibase/budibase/security/advisories/GHSA-pxwc-66g3-5f27

Get alerted when CVE-2026-72850 or the next vulnerability affects your stack