CVE-2026-35214 Budibase CVE debrief

Who should care

Budibase users, administrators, and developers should be aware of this vulnerability and take immediate action to update to version 3.33.4 or apply mitigations. Budibase users and administrators should prioritize patching and monitor for suspicious activity. Budibase developers should review the code changes in version 3.33.4 and apply relevant patches. Security teams should review the CVE record and NVD entry for additional information and guidance. Vulnerability management teams should assess the risk and prioritize remediation efforts. Operational security teams should implement compensating controls and monitor for potential attacks. IT teams should review and update their asset inventory and patch management processes.

Technical summary

The vulnerability exists in the plugin file upload endpoint (POST /api/plugin/upload) of Budibase, allowing an attacker with Global Builder privileges to delete arbitrary directories via rmSync and write arbitrary files via tarball extraction to any filesystem path the Node.js process can access. The CVSS score is 8.7, indicating a high severity. This issue has been patched in version 3.33.4. Affected Budibase users, administrators, and developers should be aware of this vulnerability and take immediate action.

Defensive priority

High priority should be given to updating Budibase to version 3.33.4 or applying mitigations to prevent exploitation. Monitor for suspicious activity on the Budibase instance and implement additional security measures to prevent path traversal attacks. Restrict access to the plugin file upload endpoint if possible. Review compensating controls for exposed systems while remediation is scheduled and verified. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Consider an exposure review for potentially affected systems and implement source tracking for changes to Budibase deployments. Consider compensating controls for exposed systems while remediation is scheduled. Consider asset inventory review for potentially affected Budibase instances. Consider rollback/change windows for urgent updates. These defensive actions should be evaluated based on the specific environment and risk assessment. Budibase users should review their instances for potential exposure and take immediate action to mitigate the vulnerability. Budibase administrators should prioritize patching and monitor for suspicious activity. Budibase developers should review the code changes in version 3.33.4 and apply relevant patches. Security teams should review the CVE record and NVD entry for additional information and guidance. Vulnerability management teams should assess the risk and prioritize remediation efforts. Operational security teams should implement compensating controls and monitor for potential attacks. IT teams should review and update their asset inventory and patch management processes. Budibase users and administrators should also consider implementing additional security measures such as input validation and access controls to to

Recommended defensive actions

• Update Budibase to version 3.33.4 or later
• Restrict access to the plugin file upload endpoint
• Monitor for suspicious activity on the Budibase instance
• Implement additional security measures to prevent path traversal attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-03T16:16:41.607Z and last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. Evidence is limited to CVE and NVD information. Defenders should verify Budibase version and patch status.

Official resources