CVE-2026-35214 Details
Description
Budibase is an open-source low-code platform. Prior to version 3.33.4, the plugin file upload endpoint (POST /api/plugin/upload) passes the user-supplied filename directly to createTempFolder() without sanitizing path traversal sequences. An attacker with Global Builder privileges can craft a multipart upload with a filename containing ../ to delete arbitrary directories via rmSync and write arbitrary files via tarball extraction to any filesystem path the Node.js process can access. This issue has been patched in version 3.33.4.
A path traversal vulnerability has been identified in Budibase, an open-source low-code platform, prior to version 3.33.4. The issue arises in the plugin file upload endpoint, which directly passes user-supplied filenames to a function that creates temporary directories, without proper sanitization. This flaw allows an attacker with Global Builder privileges to craft a multipart upload that includes path traversal sequences, enabling them to delete arbitrary directories and write files to any accessible path on the filesystem via tarball extraction. The vulnerability has been patched in version 3.33.4.
Users are advised to update to Budibase version 3.33.4 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Budibase/budibase/security/advisories/GHSA-2wfh-rcwf-wh23 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/Budibase/budibase/commit/6344d06d703660fd05995e61d581593c2349c879 | [email protected] | Patch |
| https://github.com/Budibase/budibase/pull/18240 | [email protected] | Issue TrackingPatch |
| https://github.com/Budibase/budibase/releases/tag/3.33.4 | [email protected] | ProductRelease Notes |
| https://github.com/Budibase/budibase/security/advisories/GHSA-2wfh-rcwf-wh23 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| budibase budibase | < 3.33.4 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 8, 2026 | Initial Analysis | [email protected] |
| Apr 3, 2026 | New CVE Received | [email protected] |
| Apr 3, 2026 | CVE Modified | CISA-ADP |