CVE-2026-100682
Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload…
- Risk score
- 62/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.6%
- Published
- 26 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entries to write arbitrary …
- Affected
- See advisory
- Fix
- Upgrade the product to 3.45.0 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.8 high
References
Original description
Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entries to write arbitrary files as root, enabling remote code execution.
Last activity 26 Sep 2026. Patch Forecast updates every hour.