CVE-2026-72850: Budibase before 3.40.0 Arbitrary File Write via Path Traversal
CVE-2026-72850 affects Budibase Server versions before 3.40.0, where S3 object keys are not properly sanitized. An authenticated builder can upload files whose traversal sequences survive workspace export, which may allow writes outside the intended temporary directory. The record rates it critical with CVSS 9.1, but no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-72850 is a path traversal weakness (CWE-22) in Budibase Server before 3.40.0. According to the record, S3 object keys are not properly sanitized, so traversal sequences in uploaded file names are kept during workspace export. The CNA is VulnCheck, and the vendor advisory is GHSA-pxwc-66g3-5f27.
Impact
The record describes arbitrary file write: content can be written to any path the Budibase process is allowed to write to. The CVSS 3.1 base score is 9.1 (critical), with high confidentiality, integrity and availability impact and scope changed. A VulnCheck score of 9.4 under CVSS 4.0 is also listed.
- Precondition in the record: the attacker must be an authenticated builder.
- The SSVC fields in the record mark exploitation as proof-of-concept, automatable as no, and technical impact as total.
Affected products and versions
- Product: Budibase Server.
- Affected range in the record: before 3.40.0.
- Allowed fixed version listed in the record: 3.40.0.
The record does not list separate fixed-version entries, so 3.40.0 is the boundary given by the affected range. Whether every deployment mode or edition is covered is not stated.
Exploitation status
The CISA KEV catalogue does not list this CVE, so the record does not confirm active exploitation. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00518 (percentile 0.43207), and the SSVC exploitation field is poc.
Remediation and mitigation
- Upgrade Budibase Server to 3.40.0 or later, following the vendor advisory.
- Until the upgrade is applied, restrict builder accounts to trusted users and review who can upload files and export workspaces.
- Limit the file system permissions of the Budibase process so that it can write only to the directories it needs.
- Review the vendor advisory for any additional guidance: GitHub Security Advisory.
Detection guidance
- Review audit logs for unusual file uploads by builder accounts, particularly file names with unexpected path segments.
- Monitor exports of workspaces and check for files written outside the expected temporary or export locations.
- Watch for unexpected changes to application or system files written by the Budibase process.
Limitations of the available information
The record gives no fixed-version confirmation beyond the affected range, no proof-of-concept details, and no exploitation timeline. The VulnCheck third-party advisory is listed but its content is not part of this record. Whether the issue is exploited outside the sources consulted is unknown.
Frequently asked questions
What is CVE-2026-72850?
It is a path traversal vulnerability in Budibase Server before 3.40.0 that can lead to arbitrary file writes during workspace export, according to the record.
Which version fixes it?
The record lists 3.40.0 as the boundary of the affected range, so upgrading to 3.40.0 or later is the expected remediation. Confirm against the vendor advisory.
Is it being exploited in the wild?
The CISA KEV catalogue does not list this CVE, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.