Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:*

4 briefs RSS
high advisory

Arbitrary File Write in Budibase Server via PWA Icon Upload

Budibase Server versions prior to 3.45.0 allow authenticated BUILDER role users to achieve arbitrary file write and remote code execution by uploading malicious ZIP archives to the PWA icon upload endpoint.

Budibase Server arbitrary-file-write rce web-vulnerability
1t 1c
high advisory

Arbitrary File Read in Budibase OpenAPI Import Validator

Budibase versions prior to 3.45.0 contain an arbitrary file read vulnerability caused by enabled external JSON reference resolution during OpenAPI/Swagger file imports.

Budibase +1 vulnerability web-application data-exfiltration sql-injection cve authentication-bypass sso identity-management +5
7t 3c updated
high advisory

Budibase: Multiple Vulnerabilities

Multiple vulnerabilities in Budibase allow an attacker to gain elevated privileges, perform SQL injection, bypass security measures, take over user accounts, manipulate or disclose data, and trigger a denial-of-service condition, enabling various malicious activities impacting data integrity, confidentiality, and system availability.

Budibase +3 vulnerability sql-injection privilege-escalation defense-evasion data-exfiltration denial-of-service
5t 1c 9i updated
critical advisory

Budibase Arbitrary File Read Vulnerability via PWA-zip Symlink Upload (CVE-2026-54352)

A critical vulnerability, CVE-2026-54352, in Budibase server allows an authenticated workspace builder to perform arbitrary file reads on the host system by uploading a crafted PWA zip file containing a symbolic link, leading to credential compromise and privilege escalation, potentially enabling a full global administrator takeover.

Budibase server < 3.39.9 +1 arbitrary-file-read web-vulnerability privilege-escalation credential-access symlink budibase cloud saas
4t 1c 3i