CVE-2026-54352General(budibase / budibase)

LOWCVSS 9.6 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch budibase budibase systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Budibase is an open-source low-code platform. Prior to 3.39.9, `POST /api/pwa/process-zip` at packages/server/src/api/routes/static.ts:24 accepts a builder-uploaded .zip, extracts it with [email protected] into a temp directory, then for each entry listed in icons.json validates the icon path, opens it, and streams the bytes into MinIO. The resulting object is served back via GET /api/assets/{appId}/pwa/{uuid}.png. [email protected] preserves absolute symlink targets when restoring symlink entries. The icon-source validator at packages/server/src/api/controllers/static/index.ts:259-268 resolves the icon source string against baseDir (path.resolve), checks resolvedSrc.startsWith(baseDir + path.sep) against that string, and calls fs.existsSync(resolvedSrc) which follows symbolic links to confirm the target exists. None of the three calls reject symbolic-link entries. packages/backend-core/src/objectStore/objectStore.ts:302 then calls (await fsp.open(path)).createReadStream() on the resolved path. fsp.open follows the symlink, the target file's bytes stream into MinIO, and the response of the asset-fetch endpoint returns those bytes verbatim. Result: a workspace-level builder reads any file the server process can open. This vulnerability is fixed in 3.39.9.

budibase CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Exploit / PoC references

Weakness type (CWE)

CWE-22CWE-59

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

budibase

Threat summary

Patch or workaround signal is available
6 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 5 signals
General: 2 classified signals
Disclosure: 2 classified signals
Peaked 3d ago at 3 mentions (2026-06-27); latest day: 1
6 total mentions across 4 days

Affected systems

Vendors

budibase

Products

budibase

Deep dive

Activity timeline6 mentions / 4d

Signal classification3 categories

General

233.3%

Patch

233.3%

Disclosure

233.3%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-27	3	General2Patch1
2026-06-28	1	Disclosure1
2026-06-30	1	Patch1
2026-07-28	1	Disclosure1

Full discourse6 posts

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters90d
Disclosure
#CVE-2026-54352 - Critical Path Traversal in #Budibase. #Symlink extraction allows reading #arbitrary files. #CVSS 9.6. Unpatched - limit builder access immediately. #CVEAlert #developers #100daysofcode @budibase #infosec #cybersecurity More info: https://www.valtersit.com/cve/CVE-2026-54352
Post summary
The tweet announces a critical path‑traversal vulnerability (CVE‑2026‑54352) in Budibase, describing how symlink extraction allows arbitrary file reads and recommends limiting builder access before patches are released.
010103678
1.0K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds91d
General
CVE-2026-54352 Arbitrary File Read in Budibase via Symlink Following in PWA ZIP Processing https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-54352
Post summary
The post merely lists the CVE with a headline and a reference link, offering no detailed exploitation info or remediation steps.
00050365
4.1K followersView on X
CVE@CVEnew91d
Patch
CVE-2026-54352 Budibase is an open-source low-code platform. Prior to 3.39.9, `POST /api/pwa/process-zip` at packages/server/src/api/routes/static.ts:24 accepts a builder-uploaded .… https://www.cve.org/CVERecord?id=CVE-2026-54352
Post summary
CVE-2026-54352 affects Budibase via a vulnerable POST endpoint before version 3.39.9, and the issue is addressed in that subsequent version.
00020911
58.0K followersView on X
Joey Romaine 🇺🇸 |=★=|@Tank23x060d
Disclosure
CVE-2026-54352 just dropped. Critical severity — this one moves fast. Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload New week. Sharper than the last.
Post summary
The post announces CVE‑2026‑54352 for Budibase, describing a critical arbitrary file‑read flaw via symlink upload, without mentioning exploitation, patches, or active attacks.
0000034
334 followersView on X
DFIR Lab@DFIR_Lab88d
Patch
🚨 CRITICAL: CVE-2026-54352 in Budibase (CVSS 9.6) Path traversal via symlink in low-code platform allows workspace builders to read arbitrary server files. Affects versions <3.39.9. ✅ Patch immediately to 3.39.9 #CVE #Vulnerability #PatchNow https://t.co/JGNMftVLLn
Post summary
The tweet announces a critical path‑traversal vulnerability (CVE-2026-54352) in Budibase and urges users to patch to 3.39.9.
0000045
55 followersView on X
Infoflowcloud@infoflowcloud91d
General
🚨*CVE* CVE-2026-54352 Budibase is an open-source low-code platform. Prior to 3.39.9, `POST /api/pwa/process-zip` at packages/server/src/api/routes/static.ts:24 accepts a builder-uploaded .… https://www.cve.org/CVERecord?id=CVE-2026-54352 ----- Traducción: CVE-2026-54352 Bud… http://infoflow.cloud`
Post summary
A new CVE (CVE‑2026‑54352) affecting Budibase’s API upload endpoint is reported, with a link to the CVE record, but no exploit details, patches, or active exploitation claims are provided.
0000044
89 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	budibase	budibase	-	-	-

Explore more

Back to dashboard budibase CVEs budibase vulnerabilities

What researchers are saying

CVE-2026-54352

Hugo | DevOps | Cybersecurity 🇱🇻[verified]@HugoValtersDisclosure

The tweet announces a critical path‑traversal vulnerability (CVE‑2026‑54352) in Budibase, describing how symlink extraction allows arbitrary file reads and recommends limiting builder access before patches are released.

Joey Romaine 🇺🇸 |=★=|[verified]@Tank23x0Disclosure

The post announces CVE‑2026‑54352 for Budibase, describing a critical arbitrary file‑read flaw via symlink upload, without mentioning exploitation, patches, or active attacks.

DFIR Lab[verified]@DFIR_LabPatch

The tweet announces a critical path‑traversal vulnerability (CVE-2026-54352) in Budibase and urges users to patch to 3.39.9.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The post merely lists the CVE with a headline and a reference link, offering no detailed exploitation info or remediation steps.

CVE@CVEnewPatch

CVE-2026-54352 affects Budibase via a vulnerable POST endpoint before version 3.39.9, and the issue is addressed in that subsequent version.

Infoflowcloud@infoflowcloudGeneral

A new CVE (CVE‑2026‑54352) affecting Budibase’s API upload endpoint is reported, with a link to the CVE record, but no exploit details, patches, or active exploitation claims are provided.