Arbitrary File Read in Budibase OpenAPI Import Validator

hello@craftedsignal.io — Sat, 26 Sep 2026 15:10:36 +0000

Budibase versions prior to 3.45.0 suffer from an arbitrary file read vulnerability located in the OpenAPI/Swagger import validation functionality. The issue arises because the application fails to restrict external JSON reference resolution during the import process. An attacker possessing authenticated access as a builder can exploit this misconfiguration by submitting a crafted OpenAPI specification file containing malicious file:// URI references.

When the application processes the imported specification, the underlying JSON parser attempts to resolve these external references against the host filesystem. This enables an attacker to read sensitive local files, such as environment variables, which often contain critical secrets like JWT signing keys, database credentials, and third-party API keys. Successful exploitation leads to significant security impact, including potential full system compromise, escalation of privilege, or unauthorized data access, given the sensitivity of configuration data stored in environment files.

Budibase (3.41.0 - 3.44.x) - CraftedSignal Threat Feed

Arbitrary File Read in Budibase OpenAPI Import Validator