CVE-2026-100682: Budibase Server Arbitrary File Write RCE

CVE-2026-100682 Overview

CVE-2026-100682 is an arbitrary file write vulnerability in Budibase Server versions prior to 3.45.0. The flaw resides in the Progressive Web App (PWA) icon upload endpoint, which extracts user-supplied ZIP archives without validating symbolic links. An authenticated attacker holding the BUILDER role can craft a malicious archive containing leaf symlink entries followed by duplicate file entries. The server, running as root, follows the symlinks and writes attacker-controlled content to arbitrary filesystem locations. This primitive enables remote code execution on the host. The weakness is tracked under CWE-22 (Path Traversal).

Critical Impact

Authenticated builders can achieve root-level remote code execution on the Budibase host through a malicious ZIP upload.

Affected Products

• Budibase Server versions prior to 3.45.0
• Self-hosted Budibase deployments running the PWA icon upload endpoint
• Container and bare-metal installations where the Budibase process runs as root

Discovery Timeline

• 2026-09-26 - CVE-2026-100682 published to NVD
• 2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100682

Vulnerability Analysis

The vulnerability lives in the PWA icon upload handler of Budibase Server. The endpoint accepts a ZIP archive and extracts its contents into a server-controlled directory. The extraction routine does not validate whether archive entries are symbolic links pointing outside the extraction root.

An attacker with the BUILDER role crafts a ZIP containing two entry types. The first is a leaf symlink entry whose target points to an arbitrary absolute path on the host filesystem. The second is a regular file entry with the same name as the symlink, containing attacker-controlled content. During extraction, the symlink is created first, and the subsequent write follows the link, placing attacker content at the target location.

Because the Budibase process runs as root in default deployments, the attacker can overwrite sensitive files such as /etc/cron.d/ entries, SSH authorized_keys, or systemd unit files to achieve remote code execution.

Root Cause

The extraction logic violates safe archive handling practices by trusting entry types and names from the uploaded ZIP. The handler neither resolves canonical paths nor rejects entries that would escape the extraction root through symlink traversal. This is a classic Zip Slip variant augmented with symlink following.

Attack Vector

Exploitation requires network access to the Budibase application and valid credentials for an account assigned the BUILDER role. The attacker submits a crafted ZIP archive to the PWA icon upload endpoint. No user interaction is required beyond the authenticated upload. For detailed exploitation mechanics, consult the GitHub Security Advisory GHSA-37r6-5jxh-vm83 and the VulnCheck Advisory for Budibase.

Detection Methods for CVE-2026-100682

Indicators of Compromise

• Unexpected ZIP uploads to the PWA icon upload endpoint from builder-role accounts
• New or modified files in sensitive paths such as /etc/cron.d/, /root/.ssh/authorized_keys, or systemd unit directories shortly after a Budibase upload event
• Presence of symbolic links inside Budibase application upload or asset directories
• Outbound connections or shell processes spawned by the Budibase process (node) outside normal application behavior

Detection Strategies

• Inspect Budibase application logs for PWA icon upload requests and correlate with filesystem change events
• Deploy file integrity monitoring on /etc/, /root/, and service unit directories on hosts running Budibase
• Alert on process lineage where the Budibase runtime spawns shells, package managers, or network utilities
• Review builder-role account activity for anomalous asset uploads, especially archives with unusual entry structures

Monitoring Recommendations

• Enable audit logging (auditd on Linux) for writes to privileged system paths by the Budibase service account
• Forward Budibase application and host telemetry to a centralized SIEM for correlation across upload, filesystem, and process events
• Baseline normal PWA configuration activity and flag deviations in upload frequency or payload size

How to Mitigate CVE-2026-100682

Immediate Actions Required

• Upgrade Budibase Server to version 3.45.0 or later without delay
• Audit all accounts holding the BUILDER role and revoke access for unneeded users
• Review Budibase host filesystems for unauthorized changes to system directories and credentials
• Rotate SSH keys, service credentials, and secrets accessible from the Budibase host if compromise is suspected

Patch Information

The Budibase maintainers addressed the issue in Budibase Server 3.45.0. The fix validates archive entries during extraction and rejects symbolic links that resolve outside the designated extraction directory. Refer to the GitHub Security Advisory GHSA-37r6-5jxh-vm83 for the authoritative patch reference.

Workarounds

• Run the Budibase service as an unprivileged user rather than root to limit the blast radius of arbitrary file writes
• Restrict network access to the Budibase application to trusted administrators until the patch is applied
• Enforce mandatory access controls (SELinux, AppArmor) to prevent the Budibase process from writing to sensitive system paths
• Temporarily disable PWA icon upload functionality through reverse proxy rules if upgrading is not immediately feasible

# Example: upgrade a containerized Budibase deployment
docker pull budibase/budibase:3.45.0
docker stop budibase && docker rm budibase
docker run -d --name budibase \
  --user 1000:1000 \
  -v budibase-data:/data \
  -p 10000:80 \
  budibase/budibase:3.45.0