p PatchFirst

CVE-2026-35214

CVE-2026-35214 · Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Budibase is an open-source low-code platform. Prior to version 3.33.4, the plugin file upload endpoint (POST /api/plugin/upload) passes the user-supplied filename directly to createTempFolder() without sanitizing path traversal sequences. An attacker with Global Builder privileges can craft a multipart upload with a filename containing ../ to delete arbitrary directories via rmSync and write arbitrary files via tarball extraction to any filesystem path the Node.js process can access. This issue has been patched in version 3.33.4.

CVSS 8.7 · Alta · EPSS 0,6% · Corrección disponible

Publicación
Actualización

Pila tecnológica: node

Productos y versiones afectados

  • budibase

    Versiones
    • < 3.33.4: Afectada

    Sin corrección publicada

  • @budibase/server npm

    Intervalos de versiones afectados
    • SEMVER: < 3.33.4

    Actualiza a 3.33.4

Fuentes originales

Comprueba tu servidor →