Critical severity9.1NVD Advisory· Published Aug 13, 2026

CVE-2026-72850

Description

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .. segments that escape the temporary directory during workspace export, writing arbitrary content to any path writable by the Budibase process.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Budibase/Budibasellm-fuzzy
Range: <3.40.0

Patches

Vulnerability mechanics

References

github.com/Budibase/budibase/security/advisories/GHSA-pxwc-66g3-5f27nvd
www.vulncheck.com/advisories/budibase-before-arbitrary-file-write-via-path-traversalnvd

News mentions

No linked articles in our index yet.

cvss	0.591
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000