Threat database

CVE-2026-72850 is a critical path traversal vulnerability in Budibase server versions before 3.40.0. It allows authenticated users with builder privileges to upload files with crafted filenames containing traversal sequences (e.g., ..) that are not properly sanitized. These sequences are preserved during workspace export, enabling attackers to write arbitrary files outside the intended temporary directory to any location writable by the Budibase process.

Budibase server versions before 3.40.0 have a cross-site request forgery (CSRF) vulnerability in the chat-link handoff endpoint. This flaw allows attackers to bind an external chat identity to a victim's account by tricking the victim into submitting a crafted POST request with a leaked confirmation token. Successful exploitation enables impersonation within agent operations and inheritance of victim permissions.

Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON structural characters to alter MongoDB queries, bypassing filters to read, modify, or delete arbitrary documents.

Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass per-user access controls, read arbitrary documents, execute JavaScript via $where operators, or modify collections through update and delete operations.