A path traversal flaw in Budibase versions before 3.40.0 lets authenticated builders write arbitrary content anywhere the Budibase process can write, carrying a CVSS 3.1 score of 9.1 (Critical).
What Is It
Budibase before 3.40.0 fails to properly sanitize S3 object keys. Authenticated builders can upload files with traversal sequences in their names, and those sequences are preserved through the workspace export process. By crafting filenames containing .. segments, an attacker escapes the temporary directory used during export and writes arbitrary content to any path writable by the Budibase process.
The issue is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, network-reachable, low attack complexity, no user interaction, with a changed scope and high impact to confidentiality, integrity, and availability. A secondary CVSS 4.0 assessment from the disclosing party rates it 9.4 (Critical), with high impact across both vulnerable-system and subsequent-system metrics.
Why It Matters
Arbitrary file write in the context of the application process is a well-understood path to code execution and full host compromise. The changed-scope rating reflects that impact does not stay contained within Budibase itself; anything the process can write to is in play, including files consumed by other components on the host.
The one meaningful constraint is that exploitation requires high privileges (PR:H): the attacker must already hold builder-level access. That makes this primarily a privilege-escalation and lateral-movement problem; a malicious or compromised builder account becomes a plausible route to control over the underlying system, with the actual reach depending on the process's write permissions and what consumes the files it can reach.
What's Vulnerable
- Product: Budibase server (
pkg:npm/budibase/server) - Affected versions: all versions before 3.40.0
- Fixed version: 3.40.0 and later (default status for other versions is unaffected)
Patch Status
Budibase has published a security advisory (GHSA-pxwc-66g3-5f27) and version 3.40.0 resolves the issue. Upgrade Budibase server to 3.40.0 or later.
As of 2026-08-13, CVE-2026-72850 is not listed in the CISA Known Exploited Vulnerabilities catalog, so there is no KEV entry confirming active exploitation and no KEV-mandated remediation deadline for federal agencies. Readers can verify current status directly against the catalog, linked below. Exploit maturity in the CVSS 4.0 assessment is listed as Not Defined. The record was published 2026-08-13 and remains in "Received" status at NVD, so analysis may still change.
Sources
- NVD, CVE-2026-72850: https://nvd.nist.gov/vuln/detail/CVE-2026-72850
- Budibase GitHub Security Advisory (GHSA-pxwc-66g3-5f27): https://github.com/Budibase/budibase/security/advisories/GHSA-pxwc-66g3-5f27
- VulnCheck Advisory; Budibase Arbitrary File Write via Path Traversal: https://www.vulncheck.com/advisories/budibase-before-arbitrary-file-write-via-path-traversal
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog