Budibase server versions before 3.40.0 do not properly sanitize S3 object keys, permitting authenticated users with builder privileges to upload files whose names include '..' segments. These traversal sequences are preserved during the export of workspaces, enabling attackers to write arbitrary files outside the intended temporary directory to any location writable by the Budibase process. This vulnerability is classified as an improper limitation of a pathname to a restricted directory (path traversal). It has a CVSS 4.0 score of 9.4, indicating critical severity. Budibase is a cloud-hosted service, and the vendor manages remediation server-side. Patch availability is confirmed.

An authenticated builder can exploit this vulnerability to write arbitrary files to any path writable by the Budibase server process. This can lead to unauthorized modification or creation of files, potentially compromising the integrity and security of the system. The vulnerability requires high privileges (authenticated builder) but does not require user interaction. The CVSS vector indicates network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, availability, and security requirements.

Budibase is a cloud-hosted service, and the vendor manages remediation for this vulnerability server-side. A patch is available and should be applied by the vendor. Users of Budibase server should verify with the vendor advisory that their service is updated to version 3.40.0 or later. No additional user action is required if the vendor has applied the patch.