Budibase server versions prior to 3.40.0 do not properly sanitize S3 object keys, allowing authenticated builders to upload files with path traversal sequences. These sequences are preserved during workspace export, which can lead to arbitrary file write outside the intended temporary directory. This vulnerability enables attackers to write files to any location writable by the Budibase process, potentially leading to code execution or other impacts depending on the writable paths. The vulnerability is tracked as CVE-2026-72850 with a CVSS 4.0 score of 9.4, reflecting network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, availability, and security requirements. Budibase is a cloud-hosted service, and a patch is available to address this issue.

An authenticated builder can exploit this vulnerability to write arbitrary files to any path writable by the Budibase process during workspace export. This can lead to unauthorized modification or creation of files, potentially resulting in code execution or disruption of service. The high CVSS score reflects the critical nature of this vulnerability with broad impact on confidentiality, integrity, and availability.

A patch is available for Budibase server version 3.40.0 and later that fixes this path traversal vulnerability. Since Budibase is a cloud service, the vendor typically manages remediation server-side. Users should verify with the vendor advisory that their service instance is updated to version 3.40.0 or later to ensure protection. Until then, restrict builder privileges to trusted users only.