CVE-2026-30240:

Critical path traversal vulnerability in Budibase allows authenticated users with builder privileges to read arbitrary files, potentially leading to complete platform compromise.

Score
A numerical rating that indicates how dangerous this vulnerability is.

8.1High

Published Date:Mar 9, 2026
CISA KEV Date:*No Data*
Industries Affected:20

Threat Predictions

EPSS Score:0.0
EPSS Percentile:12%

Exploitability

Score:2.8
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:LOW
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.2
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:NONE

Description Preview

Critical path traversal vulnerability in Budibase allows authenticated users with builder privileges to read arbitrary files, potentially leading to complete platform compromise.

Overview

The vulnerability in Budibase, a low-code platform for creating internal tools and workflows, poses a significant security risk. It allows authenticated users with builder privileges to access sensitive information stored on the server filesystem. The flaw exists in the PWA ZIP processing endpoint, where the server reads attacker-specified files using unsanitized path joining. This enables attackers to retrieve arbitrary files, including critical system information and credentials. The compromised data is then uploaded to the object store (MinIO/S3) and can be accessed through signed URLs. The severity of this vulnerability is critical, with a CVSS v3.1 base score of 9.6, due to its potential for complete platform compromise and the ease of exploitation.

Remediation

To address this vulnerability, organizations using Budibase should take the following steps:
1. Update Budibase to the latest version that addresses this vulnerability (version number not specified in the CVE).
2. Conduct a thorough security audit of the system to identify any potential unauthorized access or data exfiltration that may have occurred.
3. Rotate all secrets, including JWT tokens, API keys, and encryption keys that may have been exposed.
4. Implement additional access controls and monitoring for the PWA ZIP processing endpoint.
5. Enhance input validation and sanitization for file paths, particularly when processing user-uploaded content.
6. Consider implementing a least-privilege model for user roles and permissions within Budibase.
7. Regularly review and update security practices, including timely application of security patches and updates.