CVE Feed

    Dashboard / CVE / CVE-2026-100682

    CVE-2026-100682

    Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entries to write arbitrary files as root, enabling remote code execution.

    Published:Sep 26, 2026
    Last Modified:Sep 30, 2026
    EPS:Sep 26, 2026
    EPSS Score:0.00566
    CVSS Score:8.8

    Affected Products

    Vendor
    Budibase
    Product
    Server

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-100688 (CVSS 7.1) — Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/app…
    CVE-2026-100687 (CVSS 7) — Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external ta…
    CVE-2026-100686 (CVSS 8.6) — Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId…
    CVE-2026-100685 (CVSS 8.3) — Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builder…
    CVE-2026-100684 (CVSS 9.2) — Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibas…
    CVE-2026-100683 (CVSS 8.9) — Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/sr…
    CVE-2026-100681 (CVSS 6.3) — Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vul…
    CVE-2026-100680 (CVSS 8.6) — Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger impo…
    CVE-2026-82246 (CVSS 7.1) — Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoin…
    CVE-2026-82245 (CVSS 7.2) — Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High