Budibase arbitrary file write via ZIP symlink in PWA icon upload
Budibase Server before 3.45.0 extracts user-supplied ZIP archives in the PWA icon upload endpoint without symlink validation, letting Builder users write to arbitrary host filesystem paths.
- Vendor
- Budibase
- Product
- Budibase Server (versions before 3.45.0)
- CVSS
- 8.8
- EPSS (exploit probability)
- 0.6%
- Status
- patched
- Published
Budibase Server before version 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint. When processing user-supplied ZIP archives, the extraction logic does not check for symlinks. A user with Builder access can craft a ZIP file containing a symlink that resolves to an arbitrary path on the host filesystem. When the server extracts the archive, it follows the symlink and writes attacker-controlled content to that path. Depending on the deployment, reachable targets include application source directories and configuration files containing credentials.
The flaw is addressed in Budibase 3.45.0. The fix adds symlink validation during ZIP extraction. No workaround is available for earlier versions; upgrade is the only remediation.
The advisory notes no evidence of active exploitation. This CVE is not listed in the CISA KEV catalog at publication.
