High priorityDisclosed

Advisory · CVE-2026-100682

Budibase ZIP upload writes attacker files as root through symlinks

Budibase Server before 3.45.0 extracts user-supplied ZIP archives in the PWA icon upload endpoint without proper symlink validation. A BUILDER-role attacker can craft a malicious ZIP with leaf symlink entries followed by duplicate file entries to write arbitrary files as root, enabling remote code execution. Fixed in 3.45.0.

Advisory published September 26, 2026Independent summary
Vendor
Budibase
Product
Budibase
Identifier / CWE
CVE-2026-100682
CWE-22
Action timing
Immediate
ELI5

Explain it like I’m five

The delivery room unpacks boxes for the app's icon shelf. A sender labels a box 'this is just a shortcut' and then slips in a second box with the same name containing something else; the room follows the shortcut and writes the contents wherever it points, with the boss's keys.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Malicious ZIP

    A BUILDER-role attacker crafts a ZIP with leaf symlink entries followed by duplicate file entries.

  2. 02Icon upload

    The ZIP is submitted to the PWA icon upload endpoint.

  3. 03Unsafe extraction

    The server extracts the archive without proper symlink validation, following the symlinks.

  4. 04Root file write

    Arbitrary files are written as root, enabling remote code execution.

What happened

Budibase Server before 3.45.0 extracts user-supplied ZIP archives in the PWA icon upload endpoint without proper symlink validation (CVE-2026-100682, CVSS 8.8). A BUILDER-role attacker can craft a malicious ZIP with leaf symlink entries followed by duplicate file entries to write arbitrary files as root, enabling remote code execution. The issue is fixed in Budibase 3.45.0.

What to do

  1. Upgrade Budibase to 3.45.0 or later.
  2. Audit PWA icon uploads for ZIP archives submitted by builder accounts.
  3. Inspect the host filesystem for unexpected files, especially in system directories, and treat any findings as a compromise investigation.
  4. Review which accounts hold the builder role and whether each one still needs it.

Management note

Arbitrary file write as root from a low-privilege role is a full host compromise primitive, not just an app bug. Assume the worst on any instance where untrusted builders could reach the PWA upload endpoint, and investigate before you declare the upgrade sufficient.