Threats tagged 'ghsa-xphc-jppf-jrhm'

CVE-2026-100682 is a high-severity vulnerability in Budibase Server versions before 3.45.0. It involves an arbitrary file write issue in the PWA icon upload endpoint, where user-supplied ZIP archives are extracted without proper symlink validation. Attackers with BUILDER role privileges can exploit this by crafting malicious ZIP files to write arbitrary files as root, potentially leading to remote code execution.