Description

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .. segments that escape the temporary directory during workspace export, writing arbitrary content to any path writable by the Budibase process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-13T22:17:24.307Z",
  "pubdate": "2026-08-13T22:17:24.307Z",
  "executiveSummary": "Budibase before 3.40.0 suffers from a path traversal vulnerability stemming from inadequate sanitization of S3 object keys during file upload and workspace export operations. The vulnerability allows authenticated attackers with builder privileges to inject directory traversal sequences into filenames, which are subsequently preserved and processed during the workspace export routine. Successful exploitation permits an attacker to escape the designated temporary directory and write arbitrary file content to any filesystem path writable by the underlying Budibase process context. This introduces significant risk regarding system integrity, potential privilege escalation, and arbitrary file overwrite capabilities within the hosting environment. Exploitation requires authenticated access with builder permissions and the ability to upload crafted files containing path traversal sequences to the S3 object storage component.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient input validation and sanitization of S3 object keys within Budibase before 3.40.0. When files are uploaded to the S3 storage backend, the application fails to properly strip or neutralize directory traversal sequences such as dot-dot-slash (..) segments from the object keys. Consequently, these maliciously crafted filenames are stored alongside the objects and remain unaltered during subsequent internal retrieval and workspace export processes.\nThe attack flow proceeds as follows: First, an authenticated actor with builder privileges authenticates to the Budibase instance. The attacker then uploads a specially crafted file to the S3 storage component, where the object key contains sequence patterns designed to navigate upward from the destination directory (e.g., ../../../etc/cron.d/malicious or similar writable locations). During a subsequent workspace export operation, the application processes the S3 objects and attempts to write them out to the filesystem. Because the traversal sequences are preserved in the object keys, the write operation escapes the intended temporary directory boundary.\nThe vulnerable components involve the file upload handling mechanisms, S3 key processing logic, and the workspace export routine. Affected versions include all Budibase deployments prior to 3.40.0. Prerequisites for exploitation include authenticated access to the application and the assignment of builder-level privileges. Depending on the privileges and access rights of the system user running the Budibase process, post-exploitation impact includes the arbitrary creation or overwriting of system and application files, potentially leading to remote code execution or complete compromise of the underlying host environment."
}