Budibase arbitrary file write via ZIP symlink in PWA icon upload
Budibase Server before 3.45.0 extracts user-supplied ZIP archives in the PWA icon upload endpoint without symlink validation, letting Builder users write to arbitrary host filesystem paths.
- Vendor
- Budibase
- Product
- Budibase Server (versions before 3.45.0)
- CVSS
- 8.8
- EPSS (exploit probability)
- 0.7%
- Status
- patched
- Published
Is CVE-2026-100682 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-100682 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.7% (scored October 25, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-100682 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
Budibase Server before version 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint. When processing user-supplied ZIP archives, the extraction logic does not check for symlinks. A user with Builder access can craft a ZIP file containing a symlink that resolves to an arbitrary path on the host filesystem. When the server extracts the archive, it follows the symlink and writes attacker-controlled content to that path. Depending on the deployment, reachable targets include application source directories and configuration files containing credentials.
The flaw is addressed in Budibase 3.45.0. The fix adds symlink validation during ZIP extraction. No workaround is available for earlier versions; upgrade is the only remediation.
The advisory notes no evidence of active exploitation. This CVE is not listed in the CISA KEV catalog at publication.
Other Budibase CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-100684 Budibase SSO authentication bypass creates unauthorized user accountswrite-up | [ HIGH ] | 8.1 | 0.4% | — |
| CVE-2026-100683 Budibase SQL injection in MySQL and MSSQL column-rename DDLwrite-up | [ HIGH ] | 8.0 | 0.3% | — |
