Vulnerability Description
Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entries to write arbitrary files as root, enabling remote code execution.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/Budibase/budibase/security/advisories/GHSA-37r6-5jxh-vm83
- https://www.vulncheck.com/advisories/budibase-server-before-3.45.0-arbitrary-fil
- https://github.com/Budibase/budibase/security/advisories/GHSA-37r6-5jxh-vm83
FAQ
What is CVE-2026-100682?
CVE-2026-100682 is a vulnerability with a CVSS score of 8.8 (HIGH). Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with ...
How severe is CVE-2026-100682?
CVE-2026-100682 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-100682?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.