CVE-2026-54352

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.39.9

Description An issue exists where a workspace-level builder can read any file the server process has access to by uploading a specially crafted PWA zip file. The POST /api/pwa/process-zip endpoint extracts the uploaded zip using a library that preserves absolute symbolic links. The system's icon-source validator fails to reject these symbolic links, allowing a file stored within the base directory to point to sensitive system files. Subsequently, the server opens the resolved path and streams the bytes into MinIO, which are then served back to the user via the GET /api/assets/{appId}/pwa/{uuid}.png endpoint. In default Docker deployments where the server runs as root, this can lead to the disclosure of critical files such as /etc/shadow and /data/.env, which contains sensitive credentials like JWT SECRET, INTERNAL API KEY, and DATABASE URL.

Recommendations Update Budibase to version 3.39.9 or later.