CVE-2026-100682 budibase CVE debrief

Who should care

Defenders responsible for Budibase Server instances, particularly those with BUILDER role access, should assess exposure and prioritize verification and remediation. This includes reviewing system logs for suspicious activity, restricting access to the PWA icon upload endpoint, and ensuring that all instances are upgraded to version 3.45.0 or later. Additionally, defenders should consider implementing compensating controls for exposed systems while remedi

Why it matters

CVE-2026-100682 is a high-severity vulnerability in Budibase Server before 3.45.0, allowing arbitrary file writes and potentially remote code execution. Defenders should prioritize verification, remediation, and restricting access to affected instances.

• Remote code execution is possible if an attacker with BUILDER role uploads a malicious ZIP archive.
• Arbitrary file writes can occur as root, potentially leading to system compromise.
• Verification of Budibase Server instances and upgrade to version 3.45.0 or later is necessary.
• Restricting access to the PWA icon upload endpoint can help mitigate the vulnerability.

Technical summary

The vulnerability exists in the PWA icon upload endpoint of Budibase Server before 3.45.0, allowing attackers with BUILDER role to craft a malicious ZIP archive with leaf symlink entries followed by duplicate file entries, enabling arbitrary file writes as root and potentially leading to remote code execution. This vulnerability has a high CVSS score of 8.7, indicating a high severity. Defenders should prioritize verifying and upgrading Budibase Server instances to version 3.45.0 or later, and restrict access to the PWA icon upload endpoint.

Defensive priority

Defenders should prioritize verifying and upgrading Budibase Server instances to version 3.45.0 or later, and restrict access to the PWA icon upload endpoint.

Recommended defensive actions

• Verify and upgrade Budibase Server instances to version 3.45.0 or later
• Restrict access to the PWA icon upload endpoint
• Monitor for suspicious activity on Budibase Server instances
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, CVSS score, and affected versions. Budibase Server instances before 3.45.0 are vulnerable, and defenders should verify and upgrade to the latest version. The vulnerability allows attackers with BUILDER role to craft a malicious ZIP archive, potentially leading to remote code execution. Evidence is limited to public CVE details and source item descriptions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.