{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/@budibase/server--3.39.9/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.6,"id":"CVE-2026-54352"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Budibase server \u003c 3.39.9","@budibase/server \u003c 3.39.9"],"_cs_severities":["critical"],"_cs_tags":["arbitrary-file-read","web-vulnerability","privilege-escalation","credential-access","symlink","budibase","cloud","saas"],"_cs_type":"advisory","_cs_vendors":["Budibase"],"content_html":"\u003cp\u003eA critical arbitrary file read vulnerability (CVE-2026-54352) affects Budibase server versions up to \u003ccode\u003e3.39.0\u003c/code\u003e (HEAD \u003ccode\u003efeab995\u003c/code\u003e, released 2026-05-20). This flaw allows an authenticated workspace builder to read any file accessible by the server process, including highly sensitive configuration files like \u003ccode\u003e/data/.env\u003c/code\u003e (containing \u003ccode\u003eJWT_SECRET\u003c/code\u003e, \u003ccode\u003eINTERNAL_API_KEY\u003c/code\u003e, and database credentials) and system files such as \u003ccode\u003e/etc/passwd\u003c/code\u003e or \u003ccode\u003e/etc/shadow\u003c/code\u003e. The vulnerability stems from improper handling of symbolic links within uploaded PWA \u003ccode\u003e.zip\u003c/code\u003e files by the \u003ccode\u003eextract-zip@2.0.1\u003c/code\u003e library, coupled with insufficient validation in Budibase's icon processing logic. When exploited, it can lead to credential disclosure, privilege escalation to global administrator, and even cross-tenant exposure in multi-tenant environments. This vulnerability impacts self-hosted Budibase deployments, especially those running the default Docker image where the Node server executes as \u003ccode\u003eroot\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains authenticated access as a workspace builder to a Budibase instance, obtaining necessary cookies and CSRF tokens from \u003ccode\u003eGET /api/global/self\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a \u003ccode\u003e.zip\u003c/code\u003e archive containing a symbolic link, for example, \u003ccode\u003eevil.png\u003c/code\u003e, which targets a sensitive file on the server's filesystem, such as \u003ccode\u003e/data/.env\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker includes an \u003ccode\u003eicons.json\u003c/code\u003e file within the \u003ccode\u003e.zip\u003c/code\u003e that references the created symbolic link, for example, \u003ccode\u003e{\u0026quot;icons\u0026quot;:[{\u0026quot;src\u0026quot;:\u0026quot;evil.png\u0026quot;, ...}]}\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker sends an HTTP POST request to \u003ccode\u003e/api/pwa/process-zip\u003c/code\u003e with the crafted \u003ccode\u003e.zip\u003c/code\u003e file in the request body, using their authenticated session.\u003c/li\u003e\n\u003cli\u003eThe Budibase server, using \u003ccode\u003eextract-zip@2.0.1\u003c/code\u003e, extracts the \u003ccode\u003e.zip\u003c/code\u003e file into a temporary directory, preserving the absolute target of the symbolic link.\u003c/li\u003e\n\u003cli\u003eDuring PWA icon processing, the server's validator (\u003ccode\u003epackages/server/src/api/controllers/static/index.ts:259-268\u003c/code\u003e) resolves the icon path, follows the symbolic link using \u003ccode\u003efs.existsSync\u003c/code\u003e, and then opens the target file using \u003ccode\u003efsp.open\u003c/code\u003e to stream its content.\u003c/li\u003e\n\u003cli\u003eThe content of the sensitive target file (e.g., \u003ccode\u003e/data/.env\u003c/code\u003e) is then streamed into MinIO and made available via a new public URL, typically \u003ccode\u003eGET /api/assets/{appId}/pwa/{uuid}.png\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker retrieves the sensitive file's content by making a GET request to the newly generated PWA asset URL, completing the arbitrary file read.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-54352 leads to the disclosure of critical secrets from the Budibase server's host system. This includes \u003ccode\u003eJWT_SECRET\u003c/code\u003e, \u003ccode\u003eINTERNAL_API_KEY\u003c/code\u003e, \u003ccode\u003eMINIO_ACCESS_KEY\u003c/code\u003e, \u003ccode\u003eMINIO_SECRET_KEY\u003c/code\u003e, \u003ccode\u003eREDIS_PASSWORD\u003c/code\u003e, \u003ccode\u003eCOUCHDB_PASSWORD\u003c/code\u003e, and \u003ccode\u003eDATABASE_URL\u003c/code\u003e from the \u003ccode\u003e/data/.env\u003c/code\u003e file. With the leaked \u003ccode\u003eJWT_SECRET\u003c/code\u003e, an attacker can forge HS256 JWTs, escalating privileges from a workspace builder to a global administrator. This allows for full compromise of the Budibase instance, including potential cross-tenant data access on multi-tenant installations. Furthermore, if the Budibase Docker container runs as \u003ccode\u003eroot\u003c/code\u003e (the default configuration), system files like \u003ccode\u003e/etc/passwd\u003c/code\u003e and \u003ccode\u003e/etc/shadow\u003c/code\u003e are also exposed, providing additional credential harvesting opportunities.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update Budibase server to version \u003ccode\u003e3.39.9\u003c/code\u003e or newer to patch CVE-2026-54352.\u003c/li\u003e\n\u003cli\u003eRotate all credentials found in \u003ccode\u003e/data/.env\u003c/code\u003e, including \u003ccode\u003eJWT_SECRET\u003c/code\u003e, \u003ccode\u003eINTERNAL_API_KEY\u003c/code\u003e, \u003ccode\u003eMINIO_*\u003c/code\u003e, \u003ccode\u003eREDIS_PASSWORD\u003c/code\u003e, \u003ccode\u003eCOUCHDB_PASSWORD\u003c/code\u003e, and \u003ccode\u003eDATABASE_URL\u003c/code\u003e, especially if using self-hosted Budibase deployments.\u003c/li\u003e\n\u003cli\u003eImplement strong logging and monitoring for attempts to access sensitive file paths mentioned in the IOCs (e.g., \u003ccode\u003e/data/.env\u003c/code\u003e, \u003ccode\u003e/etc/passwd\u003c/code\u003e, \u003ccode\u003e/etc/shadow\u003c/code\u003e) via unexpected application endpoints.\u003c/li\u003e\n\u003cli\u003eEnsure that the Budibase server process does not run with \u003ccode\u003eroot\u003c/code\u003e privileges within its container or host environment, following the principle of least privilege, to limit the blast radius of arbitrary file read vulnerabilities.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-03T11:01:14Z","date_published":"2026-07-03T11:01:14Z","id":"https://feed.craftedsignal.io/briefs/2026-07-budibase-arbitrary-file-read/","summary":"A critical vulnerability, CVE-2026-54352, in Budibase server allows an authenticated workspace builder to perform arbitrary file reads on the host system by uploading a crafted PWA zip file containing a symbolic link, leading to credential compromise and privilege escalation, potentially enabling a full global administrator takeover.","title":"Budibase Arbitrary File Read Vulnerability via PWA-zip Symlink Upload (CVE-2026-54352)","url":"https://feed.craftedsignal.io/briefs/2026-07-budibase-arbitrary-file-read/"}],"language":"en","title":"CraftedSignal Threat Feed - @Budibase/Server \u003c 3.39.9","version":"https://jsonfeed.org/version/1.1"}