CVE-2026-30240 Details
Description
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.5 and earlier, a path traversal vulnerability in the PWA (Progressive Web App) ZIP processing endpoint (POST /api/pwa/process-zip) allows an authenticated user with builder privileges to read arbitrary files from the server filesystem, including /proc/1/environ which contains all environment variables — JWT secrets, database credentials, encryption keys, and API tokens. The server reads attacker-specified files via unsanitized path.join() with user-controlled input from icons.json inside the uploaded ZIP, then uploads the file contents to the object store (MinIO/S3) where they can be retrieved through signed URLs. This results in complete platform compromise as all cryptographic secrets and service credentials are exfiltrated in a single request.
A path traversal vulnerability has been identified in Budibase versions through 3.31.5, specifically in the Progressive Web App (PWA) ZIP processing endpoint (POST /api/pwa/process-zip). This vulnerability allows authenticated users with builder privileges to read arbitrary files from the server filesystem. Exploitation of this vulnerability can lead to the exfiltration of sensitive environment variables, including JWT secrets, database credentials, encryption keys, and API tokens. The issue arises because the server processes user-controlled input from icons.json within uploaded ZIP files without proper validation, allowing attackers to specify paths that traverse the directory structure and access sensitive files. The extracted file contents are then uploaded to an object store (MinIO/S3) where they can be accessed through signed URLs, resulting in a complete compromise of the Budibase platform.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Budibase/budibase/security/advisories/GHSA-pqcr-jmfv-c9cp | CISA-ADP | ExploitVendor Advisory |
| https://github.com/Budibase/budibase/security/advisories/GHSA-pqcr-jmfv-c9cp | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| budibase budibase | <= 3.31.5 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 13, 2026 | Initial Analysis | [email protected] |
| Mar 10, 2026 | CVE Modified | CISA-ADP |
| Mar 9, 2026 | New CVE Received | [email protected] |