Budibase Path Traversal via S3 Object Key

Executive Summary

Budibase before version 3.40.0 does not properly sanitize S3 object keys. This allows authenticated users with builder privileges to upload files containing path traversal sequences like .. These sequences are preserved when exporting workspaces, enabling attackers to escape the intended temporary directory and write arbitrary files to any location accessible by the Budibase process.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Budibase installations for versions before 3.40.0. Check for files with traversal sequences in S3 object keys or unusual paths during workspace exports. Monitor logs for unauthorized file writes outside expected directories.

Useful 0 Not Useful 0

Impact Analysis

If you use Budibase versions before 3.40.0, an attacker with builder access could overwrite critical system files, inject malicious code, or manipulate sensitive data. This could lead to remote code execution, data breaches, or service disruption depending on the files targeted.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file access or modification, violating data integrity and confidentiality requirements in GDPR and HIPAA. Organizations using vulnerable Budibase versions may face compliance violations, regulatory penalties, or loss of certification if sensitive data is exposed or altered.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Budibase to version 3.40.0 or later to address the improper sanitization of S3 object keys. Ensure all authenticated builders follow strict filename validation rules to prevent path traversal sequences.

Useful 0 Not Useful 0