Description

Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entries to write arbitrary files as root, enabling remote code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-26T14:16:52.433Z",
  "pubdate": "2026-09-26T14:16:52.433Z",
  "executiveSummary": "Budibase Server versions prior to 3.45.0 are susceptible to an arbitrary file write vulnerability within the PWA (Progressive Web App) icon upload endpoint. The vulnerability arises from improper validation of ZIP archive contents during the extraction process, specifically failing to account for symlink entries.\nBy uploading a maliciously crafted ZIP file containing symbolic links followed by duplicate file entries, an attacker possessing the BUILDER role can traverse the filesystem and overwrite sensitive files. Since the application process executes with root privileges, this write primitive facilitates arbitrary code execution on the underlying host system.\nThis vulnerability poses a critical risk, as it allows an authenticated attacker to move beyond the application's intended sandbox, compromise the integrity of the host server, and potentially establish persistent unauthorized access. Successful exploitation requires the BUILDER role, representing a privilege escalation scenario where an internal user leverages authorized functionality to bypass security controls.",
  "technicalDetails": "The root cause of this vulnerability is a path traversal flaw during the extraction of ZIP archives within the Budibase PWA icon upload functionality. The application logic fails to perform adequate sanitization or boundary checks on the entries contained within the uploaded ZIP file. Specifically, the processing library used to handle these archives does not validate symlink entries against the target destination directory, nor does it effectively handle duplicate file entries in a way that prevents path traversal.\nThe attack flow proceeds as follows: An attacker authenticated with the BUILDER role initiates an upload request to the PWA icon endpoint, supplying a specially crafted ZIP archive. The archive structure is designed to leverage symlink handling; the attacker includes a symlink entry that points to a sensitive location on the host filesystem (e.g., /etc/cron.d/ or an application source file).\nUpon processing the archive, the application extracts the symlink. If the system follows this link during the subsequent extraction of the payload file (which may be masked or provided as a duplicate entry in the archive), the application inadvertently writes the contents of the payload to the path referenced by the symlink. Because the Budibase Server process executes with root privileges, it possesses the necessary permissions to write to restricted directories that would otherwise be protected from standard user access.\nBy targeting system-level configuration files or application scripts that are executed periodically, the attacker can achieve remote code execution (RCE). Once the payload is successfully written to an executable location or a configuration file that influences system behavior, the attacker can trigger the execution of arbitrary commands, effectively gaining full control over the container or host instance. This vulnerability is restricted to versions prior to 3.45.0 and is exploitable only by users already granted the BUILDER role, highlighting the importance of strict authorization and input validation in high-privilege application components."
}