CVE Intelligence
Analysis AI-assisted

CVE-2026-54352: Budibase Path Traversal via Symlinks in PWA Icon Upload

Budibase versions before 3.39.9 let a workspace-level builder upload a .zip whose icon entries are symbolic links, causing the server to read files the server process can open and expose them through an asset endpoint. The record rates the issue critical (CVSS 3.1 base score 9.6) with high confidentiality and integrity impact. No KEV listing or confirmed exploitation appears in the sources consulted, and the record states the issue is fixed in 3.39.9.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Budibase is an open-source low-code platform. According to the GitHub advisory referenced in the record, versions before 3.39.9 contain a path traversal weakness in the PWA icon processing flow, where symbolic links inside an uploaded archive are followed when the server reads the target. The weakness is classified as CWE-22 (Path Traversal).

Impact

  • The record scores the issue at 9.6 (critical) under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N.
  • Per that vector, confidentiality and integrity impact are rated high and availability impact is rated none.
  • The record describes the outcome as a builder being able to read files the server process can open, with contents retrievable through the asset endpoint.

Affected products and versions

  • Budibase Budibase: versions less than 3.39.9.
  • The record lists no other affected version ranges.

Exploitation status

The CVE is not listed in CISA KEV in the record. No confirmed active exploitation appears in the sources consulted. The GitHub advisory reference is tagged as Exploit in the record, but that tag alone does not establish that exploitation has occurred. The EPSS probability in the record is 0.00494 with a percentile of 0.4071.

Remediation and mitigation

  • Upgrade Budibase to version 3.39.9 or later, which the record identifies as the fixed version.
  • Limit builder roles to trusted users until the upgrade is applied, since the record requires a builder-level account.
  • Review recent PWA icon uploads and builder account activity for anything unexpected.
  • Check the GitHub advisory for vendor guidance.

Detection guidance

  • Review application logs for uploads to the PWA processing endpoint and for asset retrieval requests made by builder accounts.
  • Where archives are processed by custom tooling, inspect entries for symbolic links before extraction and reject archives that contain them.
  • Monitor for unexpected outbound storage writes or unusual asset content types.

Limitations of the available information

  • The source record has no title, so the titles here are derived from the description.
  • The record contains no fixes list entries and no patch commit reference, beyond the statement that 3.39.9 fixes the issue.
  • The record does not describe the exact exploit conditions or confirm whether public exploit code exists.
  • The absence of a KEV listing does not confirm that exploitation is absent.

Frequently asked questions

What is the vulnerability in Budibase?

A path traversal weakness in the PWA icon processing flow lets symbolic links in an uploaded archive be followed, so files the server process can open may be read and returned through an asset endpoint.

Which versions are affected?

The record lists Budibase versions less than 3.39.9 as affected, and states that the issue is fixed in 3.39.9.

Is this vulnerability being exploited?

The CVE is not listed in CISA KEV in the record, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.