CVE-2026-54352

What it is

Budibase is an open-source low-code platform. Prior to 3.39.9, `POST /api/pwa/process-zip` at packages/server/src/api/routes/static.ts:24 accepts a builder-uploaded .zip, extracts it with [email protected] into a temp directory, then for each entry listed in icons.json validates the icon path, opens it, and streams the bytes into MinIO. The resulting object is served back via GET /api/assets/{appId}/pwa/{uuid}.png. [email protected] preserves absolute symlink targets when restoring symlink entries. The icon-source validator at packages/server/src/api/controllers/static/index.ts:259-268 resolves the icon source string against baseDir (path.resolve), checks resolvedSrc.startsWith(baseDir + path.sep) against that string, and calls fs.existsSync(resolvedSrc) which follows symbolic links to confirm the target exists. None of the three calls reject symbolic-link entries. packages/backend-core/src/objectStore/objectStore.ts:302 then calls (await fsp.open(path)).createReadStream() on the resolved path. fsp.open follows the symlink, the target file's bytes stream into MinIO, and the response of the asset-fetch endpoint returns those bytes verbatim. Result: a workspace-level builder reads any file the server process can open. This vulnerability is fixed in 3.39.9.

At a glance

Exploitability

Can be exploited over the network with a low-privilege account. High risk of data exposure, data tampering.

Exploit odds

0.5% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-06-26 21:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-06-30 20:00 UTC Last updatedMost recent change to the record

Details

Published

2026-06-26 21:16 UTC

Last modified

2026-06-30 20:00 UTC

Exploit probability

0.5% · EPSS, next 30 days

Weakness

CWE-22 · Path traversal

Record status

Analyzed

Affected

• Budibase < 3.39.9

Attack profile CVSS 3.1 · 9.6

Attack vector

Network

Complexity

Low

Privileges needed

Low

User interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None