CVE-2026-100682
Received Received - Intake

Arbitrary File Write in Budibase Server via Malicious ZIP Upload

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entries to write arbitrary files as root, enabling remote code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100682
EUVD
EUVD-2026-87655

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
budibase server to 3.45.0 (exc)
budibase budibase_server to 3.45.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100682 is an arbitrary file write vulnerability in Budibase Server before version 3.45.0. It occurs in the PWA icon upload endpoint where ZIP archives are extracted without proper symlink validation. Attackers with the BUILDER role can upload a malicious ZIP containing symlink entries followed by duplicate files to write arbitrary files as root, enabling remote code execution.

Detection Guidance

Check Budibase server version with 'curl -s http://localhost:10000/api/version' or 'docker inspect <container> | grep Budibase'. Look for versions before 3.45.0. Monitor logs for failed PWA icon uploads returning 400 errors after ZIP processing.

Impact Analysis

This vulnerability allows attackers to write arbitrary files as root on the server. This could lead to remote code execution, allowing attackers to take full control of the system, steal sensitive data, or disrupt services. The exploit is stealthy as it returns a 400 error after damage is done.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. It may result in data breaches, unauthorized modifications, or system disruptions, all of which are non-compliant with these regulations.

Mitigation Strategies

Upgrade Budibase to version 3.45.0 or later immediately. Disable PWA icon uploads if not needed. Implement stricter file validation and use non-root user in Docker containers. Replace extract-zip library with a secure alternative.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100682. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart