CVE-2026-35214

Katalog CVE

CVSS 8.7 · High EPSS 0,65%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada budibase. Skor CVSS 3.1 8.7 (High) menurut github.com.

Deskripsi (NVD)

Budibase is an open-source low-code platform. Prior to version 3.33.4, the plugin file upload endpoint (POST /api/plugin/upload) passes the user-supplied filename directly to createTempFolder() without sanitizing path traversal sequences. An attacker with Global Builder privileges can craft a multipart upload with a filename containing ../ to delete arbitrary directories via rmSync and write arbitrary files via tarball extraction to any filesystem path the Node.js process can access. This issue has been patched in version 3.33.4.

Rincian

Terbit di NVD

3 April 2026

Terakhir diubah

6 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

8.7 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,65% peluang dieksploitasi; lebih tinggi dari 49,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Budibase/budibase/security/advisories/GHSA-2wfh-rcwf-wh23 exploit · mitigasi · advisory vendor
• https://github.com/Budibase/budibase/commit/6344d06d703660fd05995e61d581593c2349c879 patch
• https://github.com/Budibase/budibase/pull/18240 issue tracking · patch
• https://github.com/Budibase/budibase/releases/tag/3.33.4 product · release notes