CVE-2026-35214: 
JavaScript vulnerability analysis and mitigation

CVE-2026-35214 is a path traversal vulnerability in Budibase, an open-source low-code platform, affecting the plugin file upload endpoint (POST /api/plugin/upload). The vulnerability allows an authenticated attacker with Global Builder privileges to craft a multipart upload with a filename containing ../ sequences, enabling arbitrary directory deletion and arbitrary file writes to any filesystem path accessible by the Node.js process. All versions prior to 3.33.4 of the @budibase/server npm package are affected. The advisory was published on April 2, 2026, and patched in version 3.33.4 released March 13, 2026. The CVSS v3.1 base score is 8.7 (High) (Github Advisory, Budibase Security Advisory).

The root cause (CWE-22: Path Traversal) lies in packages/server/src/api/controllers/plugin/file.ts, where the fileUpload() function strips the .tar.gz suffix from the user-supplied filename and passes the result directly to createTempFolder() without sanitization. The createTempFolder() function in filesystem.ts uses Node.js path.join() to construct a path relative to /tmp/.budibase, which resolves ../ sequences — allowing a filename like ../../etc/target.tar.gz to resolve to /etc/target. The function then calls fs.rmSync() recursively on the resolved path (deleting any existing directory) and fs.mkdirSync() to create it, followed by tarball extraction of attacker-controlled content. The multipart filename originates from the Content-Disposition header, parsed by formidable via koa-body 4.2.0, which does not sanitize path traversal sequences. Notably, other code paths in the same codebase use server-generated random names or UUIDs, making the file upload path the only caller of createTempFolder() that passes unsanitized user input (Budibase Security Advisory, Github Advisory).

Successful exploitation enables arbitrary directory deletion via rmSync with { recursive: true, force: true }, which can destroy application data directories, node_modules, or system directories, causing denial of service. Attackers can also write arbitrary attacker-controlled files to any writable filesystem path via tarball extraction, potentially overwriting application code, configuration files, or startup scripts. In containerized Budibase deployments where Node.js runs as root (a common configuration), overwriting startup scripts or application code could lead to remote code execution on subsequent application restarts. Confidentiality is not directly impacted, as the vulnerability enables write and delete operations but not file reads (Budibase Security Advisory).

A proof-of-concept exploit is publicly available in the official security advisory, consisting of a concrete bash sequence using curl to upload a crafted tarball with a traversal filename against a live Budibase deployment (Budibase Security Advisory). Exploitation requires authentication with Global Builder (GLOBAL_BUILDER) privileges, which is the highest non-admin role in Budibase. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.063% (0.00112 per Feedly), placing it in the 20th percentile for exploitation probability (Github Advisory).

1. Obtain Global Builder credentials: Acquire valid session credentials for a Budibase account with the GLOBAL_BUILDER role (e.g., through phishing, credential stuffing, or insider access).
2. Prepare the malicious tarball: Create a tarball containing the files to be written to the target path:

   mkdir -p /tmp/plugin-poc && echo "pwned" > /tmp/plugin-poc/test.txt
   tar czf /tmp/poc-plugin.tar.gz -C /tmp/plugin-poc .

3. Craft the traversal filename: Construct a multipart upload request where the Content-Disposition filename contains path traversal sequences ending in .tar.gz (e.g., ../../tmp/pwned.tar.gz for a non-destructive demo, or ../../app/startup.js.tar.gz for a more targeted attack).
4. Send the malicious upload: Submit the crafted request to the plugin upload endpoint with a valid session cookie:

   curl -X POST 'http://<target>:10000/api/plugin/upload' \
     -H 'Cookie: <session_cookie>' \
     -F "file=@/tmp/poc-plugin.tar.gz;filename=../../tmp/pwned.tar.gz"

5. Trigger filesystem operations: The server resolves the traversal path (e.g., /tmp/.budibase/../../tmp/pwned → /tmp/pwned), deletes any existing directory at that path via rmSync, creates the directory, and extracts the tarball contents.
6. Achieve objective: Verify file write success (e.g., ls /tmp/pwned/test.txt). For code execution, target writable application or startup script paths and wait for the application to restart (Budibase Security Advisory).

• Network: Unusual POST requests to /api/plugin/upload where the multipart Content-Disposition header's filename field contains ../ sequences or resolves outside /tmp/.budibase; requests from unexpected IP addresses using valid Global Builder session tokens.
• File System: Unexpected files or directories created outside /tmp/.budibase, particularly in application directories, /etc/, or other system paths; newly created directories at traversed paths (e.g., /tmp/pwned) containing attacker-controlled files; missing or deleted directories that previously existed (evidence of rmSync execution).
• Logs: Node.js/Budibase server logs showing POST /api/plugin/upload requests with filenames containing .. sequences; filesystem errors related to rmSync or mkdirSync on paths outside the expected temp directory; tarball extraction errors at unexpected filesystem locations.
• Process: Unexpected child processes spawned by the Budibase Node.js process following a plugin upload, particularly after application restarts if startup scripts were overwritten (Budibase Security Advisory).

Upgrade Budibase to version 3.33.4 or later, which was released on March 13, 2026, and includes the fix merged via PR #18240 (commit 6344d06) (Budibase Release 3.33.4, Fix PR). The fix sandboxes temp directories using fs.mkdtempSync with sanitized prefixes, adds an assertWithinTempDir guard to prevent traversal outside the temp directory, and strips traversal sequences from uploaded filenames. As a workaround prior to patching, restrict the Global Builder role to only fully trusted users and implement filesystem-level access controls (e.g., running the Node.js process as a non-root user with minimal filesystem permissions) to limit the blast radius of arbitrary file write/delete operations (Budibase Security Advisory).

The vulnerability was discovered and reported by bugbunny.ai and published by Budibase maintainer mjashanks on April 2, 2026 (Budibase Security Advisory). The Hacker Wire published coverage linking the vulnerability to broader Budibase security issues including a related XSS/account takeover finding (The Hacker Wire). Social media activity was observed on Bluesky shortly after disclosure. No significant broader industry commentary or threat actor attribution has been reported.