High severity8.7NVD Advisory· Published Apr 3, 2026· Updated Apr 8, 2026
CVE-2026-35214
CVE-2026-35214
Description
Budibase is an open-source low-code platform. Prior to version 3.33.4, the plugin file upload endpoint (POST /api/plugin/upload) passes the user-supplied filename directly to createTempFolder() without sanitizing path traversal sequences. An attacker with Global Builder privileges can craft a multipart upload with a filename containing ../ to delete arbitrary directories via rmSync and write arbitrary files via tarball extraction to any filesystem path the Node.js process can access. This issue has been patched in version 3.33.4.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@budibase/servernpm | < 3.33.4 | 3.33.4 |
Affected products
2Patches
Vulnerability mechanics
References
6- github.com/Budibase/budibase/commit/6344d06d703660fd05995e61d581593c2349c879nvdPatchWEB
- github.com/Budibase/budibase/pull/18240nvdIssue TrackingPatchWEB
- github.com/Budibase/budibase/security/advisories/GHSA-2wfh-rcwf-wh23nvdExploitMitigationVendor AdvisoryWEB
- github.com/advisories/GHSA-2wfh-rcwf-wh23ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-35214ghsaADVISORY
- github.com/Budibase/budibase/releases/tag/3.33.4nvdProductRelease NotesWEB
News mentions
0No linked articles in our index yet.