CVE-2026-100682

EUVD-2026-87655
Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entries to write arbitrary files as root, enabling remote code execution.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
budibasebudibase
𝑥
< 3.45.0
CNA
Common Weakness Enumeration
References
https://github.com/Budibase/budibase/security/advisories/GHSA-37r6-5jxh-vm83
https://www.vulncheck.com/advisories/budibase-server-before-3.45.0-arbitrary-file-write-via-zip-symlink