CVE-2026-30240: Budibase Path Traversal Vulnerability

CVE-2026-30240 Overview

CVE-2026-30240 is a critical path traversal vulnerability in Budibase, a popular low-code platform for creating internal tools, workflows, and admin panels. The vulnerability exists in the PWA (Progressive Web App) ZIP processing endpoint (POST /api/pwa/process-zip) and allows an authenticated user with builder privileges to read arbitrary files from the server filesystem.

The flaw stems from unsanitized path.join() operations with user-controlled input from icons.json inside uploaded ZIP files. An attacker can leverage this to access sensitive system files including /proc/1/environ, which contains all environment variables—JWT secrets, database credentials, encryption keys, and API tokens. The server reads attacker-specified files and uploads them to the object store (MinIO/S3), where they can be retrieved through signed URLs.

Critical Impact

This vulnerability enables complete platform compromise through exfiltration of all cryptographic secrets and service credentials in a single request. Attackers with builder-level access can extract JWT secrets, database credentials, and encryption keys.

Affected Products

• Budibase version 3.31.5 and earlier

Discovery Timeline

• 2026-03-09 - CVE CVE-2026-30240 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-30240

Vulnerability Analysis

This path traversal vulnerability (CWE-22) affects the PWA ZIP processing functionality in Budibase. When a user uploads a ZIP file to the /api/pwa/process-zip endpoint, the server processes an icons.json file contained within the archive. The vulnerability occurs because file paths specified in icons.json are passed directly to path.join() without proper sanitization.

By crafting a malicious icons.json file with directory traversal sequences (e.g., ../../../), an attacker can escape the intended directory and reference arbitrary files on the server filesystem. The server then reads these files and uploads them to the configured object store (MinIO or S3), making them accessible via signed URLs that the attacker can retrieve.

The most damaging target is /proc/1/environ, which contains all environment variables of the main process including JWT signing secrets, database connection strings, API tokens, and encryption keys. Exfiltration of these credentials enables complete platform takeover.

Root Cause

The root cause is the use of unsanitized user-controlled input in file path operations. The path.join() function in Node.js does not prevent directory traversal—when given input like ../../etc/passwd, it will resolve to a path outside the intended directory. The application fails to validate that the resolved path remains within the expected directory boundary before reading file contents.

Attack Vector

The attack requires network access and authentication with builder privileges. An attacker crafts a malicious ZIP file containing an icons.json file with path traversal payloads pointing to sensitive files. Upon upload to the PWA processing endpoint, the server reads the targeted files and stores them in the object store. The attacker can then retrieve the exfiltrated data via signed URLs, gaining access to all server secrets and credentials without any user interaction required.

The vulnerability mechanism involves crafting a malicious icons.json file within a ZIP archive that contains path traversal sequences targeting sensitive files like /proc/1/environ. When processed by the vulnerable endpoint, the server reads the specified files and uploads them to the object store. Technical details are available in the GitHub Security Advisory.

Detection Methods for CVE-2026-30240

Indicators of Compromise

• Unusual requests to the /api/pwa/process-zip endpoint, particularly with abnormally large or suspicious ZIP file uploads
• Object store entries containing sensitive system file contents such as environment variables or configuration files
• Access logs showing retrieval of unexpected signed URLs from MinIO/S3 buckets
• Evidence of ZIP files uploaded containing icons.json with path traversal patterns like ../

Detection Strategies

• Monitor HTTP requests to /api/pwa/process-zip for abnormal patterns or frequency from specific user accounts
• Implement web application firewall (WAF) rules to detect path traversal sequences in request payloads
• Audit object store access logs for unusual file retrievals or newly created objects with suspicious naming patterns
• Review application logs for file read operations targeting paths outside the PWA processing directory

Monitoring Recommendations

• Enable detailed logging for the PWA processing endpoint including uploaded file metadata
• Configure alerts for any access to sensitive system paths like /proc/, /etc/, or configuration directories
• Monitor builder-privileged accounts for unusual activity patterns or bulk data access
• Implement file integrity monitoring on critical configuration files and environment variable sources

How to Mitigate CVE-2026-30240

Immediate Actions Required

• Upgrade Budibase to a patched version as soon as one becomes available from the vendor
• Rotate all secrets exposed through environment variables including JWT secrets, database credentials, API tokens, and encryption keys
• Review object store contents for evidence of unauthorized file exfiltration
• Audit builder account activity for suspicious ZIP uploads to the PWA endpoint

Patch Information

Refer to the GitHub Security Advisory for the latest patch information and updated version details. Organizations should prioritize upgrading from version 3.31.5 and earlier to a patched release.

Workarounds

• Restrict access to the /api/pwa/process-zip endpoint using network-level controls or reverse proxy rules until a patch is applied
• Limit builder privileges to only essential trusted users and audit existing builder accounts
• Implement additional input validation at the reverse proxy or WAF level to block path traversal sequences in uploaded files
• Consider temporarily disabling PWA functionality if not critical to operations

# Example: Block access to vulnerable endpoint via nginx
location /api/pwa/process-zip {
    deny all;
    return 403;
}