Threats tagged 'ghsa-w7mq-r738-x278'

Budibase server versions up to 3.39.8 have a critical vulnerability (CVE-2026-54352) allowing workspace builders to read arbitrary files on the server by uploading a crafted PWA zip containing symlinks. The vulnerability arises because the extract-zip library preserves absolute symlink targets, and the icon path validation does not reject symlinks pointing outside the allowed directory. This enables reading sensitive files such as /data/.env containing secrets. The default Docker image runs the server as root, increasing impact. The vulnerability is not present in managed cloud-hosted Budibase tenants where filesystem access is sandboxed. A patch is available.