CVE-2026-72850 Budibase before 3.40.0 Arbitrary File Write via Path Traversal
Authenticated builders can exploit path traversal in S3 key sanitization to write arbitrary files during workspace export, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-72850?
CVE-2026-72850 is a critical path traversal vulnerability in budibase server, published on 13 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .. segments that escape the temporary directory during workspace export, writing arbitrary content to any path writable by the Budibase process.
Weakness: CWE-22
Which versions are affected by CVE-2026-72850?
How do I fix CVE-2026-72850?
No fix has been published for CVE-2026-72850 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-72850 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-72850 exists.
Sources
Also known as GHSA-ccjw-whgg-h4gh, GHSA-pxwc-66g3-5f27.