PT-2026-30191 · Budibase · Budibase

Bugbunny-Research · Published 2026-04-03 · Updated 2026-04-04 · CVE-2026-35214

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.33.4

Description Budibase is an open-source low-code platform. The plugin file upload endpoint, ''/api/plugin/upload'', passes user-supplied filenames directly to the createTempFolder() function without sanitizing path traversal sequences. An attacker with Global Builder privileges can craft a multipart upload with a filename containing '../' to delete arbitrary directories using rmSync and write arbitrary files via tarball extraction to any filesystem path the Node.js process can access.

Recommendations Update to version 3.33.4 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-35214

GHSA-2WFH-RCWF-WH23

Affected Products

Budibase

References · 10

• 🔥 https://github.com/Budibase/budibase/security/advisories/GHSA-2wfh-rcwf-wh23 · Exploit
• https://github.com/Budibase/budibase/commit/6344d06d703660fd05995e61d581593c2349c879 · Patch
• https://github.com/Budibase/budibase/pull/18240 · Patch
• https://osv.dev/vulnerability/GHSA-2wfh-rcwf-wh23 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35214 · Security Note
• https://github.com/Budibase/budibase · Note
• https://github.com/Budibase/budibase/releases/tag/3.33.4 · Note
• https://twitter.com/CveFindCom/status/2040115188360257717 · Twitter Post
• https://twitter.com/CVEnew/status/2040111819189297201 · Twitter Post
• https://twitter.com/TheHackerWire/status/2040327893574901849 · Twitter Post