9.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54352

CVE-2026-54352: Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload

Budibase is an open-source low-code platform. Prior to 3.39.9, POST /api/pwa/process-zip at packages/server/src/api/routes/static.ts:24 accepts a builder-uploaded .zip, extracts it with extract-zip@2.0.1 into a temp directory, then for each entry listed in icons.json validates the icon path, opens it, and streams the bytes into MinIO. The resulting object is served back via GET /api/assets/{appId}/pwa/{uuid}.png. extract-zip@2.0.1 preserves absolute symlink targets when restoring symlink entries. The icon-source validator at packages/server/src/api/controllers/static/index.ts:259-268 resolves the icon source string against baseDir (path.resolve), checks resolvedSrc.startsWith(baseDir + path.sep) against that string, and calls fs.existsSync(resolvedSrc) which follows symbolic links to confirm the target exists. None of the three calls reject symbolic-link entries. packages/backend-core/src/objectStore/objectStore.ts:302 then calls (await fsp.open(path)).createReadStream() on the resolved path. fsp.open follows the symlink, the target file's bytes stream into MinIO, and the response of the asset-fetch endpoint returns those bytes verbatim. Result: a workspace-level builder reads any file the server process can open. This vulnerability is fixed in 3.39.9.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54352

CVE-2026-54352:

9.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@budibase/server	npm	< 3.39.9	3.39.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal and arbitrary file read issue caused by improper handling of symbolic links in uploaded PWA icon archives. The core of the vulnerability lies in the processPWAZip function, which is exposed via the /api/pwa/process-zip API endpoint to users with builder permissions.

The processPWAZip function failed to properly validate the contents of the uploaded zip file. It used fs.existsSync to check for the existence of icon files specified in icons.json. Since fs.existsSync follows symbolic links, an attacker could create a zip file containing a symlink pointing to a sensitive file on the server, such as /data/.env. The validation would pass because the target file exists.

After the flawed validation, the processPWAZip function would invoke the objectStore.save function, passing the path to the symlink. The save function would then read the file from the provided path using fsp.open, which also follows symlinks. This resulted in the contents of the sensitive file being read and saved to the object store, making them accessible to the attacker.

The patch rectifies this by replacing fs.existsSync with fsp.lstat (which does not follow symlinks) and fsp.realpath within the processPWAZip function. This ensures that any provided icon path is a regular file and its canonical path is confined within the temporary extraction directory, thus mitigating the vulnerability.

Vulnerable functions

processPWAZip

packages/server/src/api/controllers/static/index.ts

This function processes uploaded PWA zip files. The original implementation used `fs.existsSync` to validate icon paths, a method that follows symbolic links. This flaw allowed an attacker to craft a zip archive containing a symlink to any file readable by the server process (e.g., `/data/.env`). The function would then incorrectly validate this symlink and proceed to read the sensitive target file, treating it as an icon.

save

packages/backend-core/src/objectStore/objectStore.ts

This function is called by `processPWAZip` to save the validated icon file to object storage. During an exploit, it receives the path to the symbolic link. The function then uses a file-reading mechanism like `fsp.open().createReadStream()` which follows the symlink, reading the contents of the sensitive file instead of the intended icon. This function is a critical part of the exploit chain as it performs the actual unauthorized file access.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.