CVE-2026-54352 Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload
A workspace builder can read arbitrary server files by uploading a zip containing symlinks, bypassing path validation checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54352?
CVE-2026-54352 is a critical path traversal vulnerability in budibase, published on 26 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Budibase is an open-source low-code platform. Prior to 3.39.9, `POST /api/pwa/process-zip` at packages/server/src/api/routes/static.ts:24 accepts a builder-uploaded .zip, extracts it with [email protected] into a temp directory, then for each entry listed in icons.json validates the icon path, opens it, and streams the bytes into MinIO. The resulting object is served back via GET /api/assets/{appId}/pwa/{uuid}.png. [email protected] preserves absolute symlink targets when restoring symlink entries. The icon-source validator at packages/server/src/api/controllers/static/index.ts:259-268 resolves the icon source string against baseDir (path.resolve), checks resolvedSrc.startsWith(baseDir + path.sep) against that string, and calls fs.existsSync(resolvedSrc) which follows symbolic links to confirm the target exists. None of the three calls reject symbolic-link entries. packages/backend-core/src/objectStore/objectStore.ts:302 then calls (await fsp.open(path)).createReadStream() on the resolved path. fsp.open follows the symlink, the target file's bytes stream into MinIO, and the response of the asset-fetch endpoint returns those bytes verbatim. Result: a workspace-level builder reads any file the server process can open. This vulnerability is fixed in 3.39.9.
Which versions are affected by CVE-2026-54352?
2 open source packages ship an affected version, including @budibase/server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@budibase/server npm | All versions | 3.39.9 |
@budibase/server npm | All versions | 3.39.9 |
Products include Budibase Budibase.
How do I fix CVE-2026-54352?
Upgrade @budibase/server to 3.39.9 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-54352 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54352 exists.
Other vulnerabilities in budibase
- CVE-2026-54350 Budibase: Anonymous NoSQL operator injection via published-app query templates
- CVE-2026-27702 Budibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)
- CVE-2026-31818 Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
- CVE-2026-30240 Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets
- CVE-2026-41428 Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints
Sources
Also known as GHSA-w7mq-r738-x278.