Threats tagged 'ghsa-fc2x-q7pq-fp49'

Budibase server versions prior to 3.45.0 contain a vulnerability in the OpenAPI/Swagger import validator that allows authenticated builder users to read arbitrary local files. This occurs because external JSON reference resolution is not disabled, enabling attackers to embed file:// references to exfiltrate sensitive information such as environment variables, JWT secrets, API keys, and database credentials.