Budibase Low-Code Platform Suffers Critical Path Traversal Vulnerability

CVE Notify is flagging a serious security flaw in the open-source low-code platform, Budibase. Versions prior to 3.33.4 are vulnerable to path traversal attacks via the plugin file upload endpoint. According to CVE Notify, an attacker with Global Builder privileges can exploit this by submitting a crafted filename containing directory traversal sequences (like ‘../’) in a multipart upload request to /api/plugin/upload.

This vulnerability allows an attacker to delete arbitrary directories using rmSync and write files to any location accessible by the Node.js process through tarball extraction. The core issue stems from the platform’s failure to sanitize user-supplied filenames before passing them to the createTempFolder() function. This oversight essentially grants attackers a direct line to manipulate the server’s filesystem.

The good news is that Budibase has addressed this vulnerability. CVE Notify confirms that the issue has been patched in version 3.33.4. Users are strongly advised to upgrade to this latest version immediately to mitigate the risk.