Executive Summary

CVE-2026-30240 is a critical path traversal vulnerability in Budibase, a low code platform, affecting the Progressive Web App (PWA) ZIP processing endpoint (POST /api/pwa/process-zip). An authenticated user with builder privileges can exploit this flaw by uploading a specially crafted ZIP file containing an icons.json file with paths that traverse outside the intended directory.

The server uses an unsafe path joining method (path.join) without validating that the resolved file paths remain within the temporary extraction directory. This allows the attacker to read arbitrary files on the server filesystem, including sensitive environment files like /proc/1/environ, which contain environment variables such as JWT secrets, database credentials, encryption keys, and API tokens.

The server then uploads the contents of these files to an object store (MinIO or S3), where the attacker can retrieve them via signed URLs. This results in complete platform compromise as all cryptographic secrets and service credentials are exfiltrated in a single request.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to complete platform compromise. An attacker with builder privileges can exfiltrate all environment secrets, including JWT signing keys, database passwords, encryption keys, API tokens, Redis passwords, MinIO keys, and internal URLs.

With leaked JWT secrets, attackers can forge admin authentication tokens, gaining unauthorized administrative access. Leaked database credentials provide full read/write access to all tenant databases, potentially exposing sensitive data.

On Budibase Cloud, this vulnerability allows cross-tenant data access, affecting thousands of tenants. Confirmed live exploitation exposed critical secrets such as AWS IAM keys, CouchDB admin credentials, CloudFront RSA private keys, and OpenAI API keys.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring for suspicious POST requests to the endpoint /api/pwa/process-zip from authenticated users with builder privileges. Specifically, look for uploads of ZIP files containing an icons.json file with path traversal sequences such as "../" in the icon.src entries.'}, {'type': 'paragraph', 'content': 'Detection can involve inspecting server logs for such POST requests and analyzing the contents of uploaded ZIP files for malicious path traversal attempts.'}, {'type': 'paragraph', 'content': 'Suggested commands to detect exploitation attempts include:'}, {'type': 'list_item', 'content': 'Using grep to find suspicious POST requests in web server logs: grep -i "/api/pwa/process-zip" /var/log/nginx/access.log | grep POST'}, {'type': 'list_item', 'content': 'Extracting and inspecting icons.json from uploaded ZIP files to check for "../" sequences: unzip suspicious.zip icons.json && grep "\\.\\./" icons.json'}, {'type': 'list_item', 'content': 'Monitoring object store (MinIO/S3) uploads for unexpected keys or files that could indicate exfiltration of sensitive files.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting builder privileges to trusted users only, as the vulnerability requires authenticated builder access.

Avoid uploading untrusted ZIP files to the /api/pwa/process-zip endpoint until a patch is available.

Implement network-level controls to monitor and block suspicious POST requests to the vulnerable endpoint.

Apply any available patches or updates from Budibase as soon as they are released to fix the path traversal vulnerability.

Review and rotate all potentially compromised secrets such as JWT signing keys, database credentials, encryption keys, API tokens, and cloud keys if exploitation is suspected.

Useful 0 Not Useful 0