Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets

The impact of CVE-2026-30240 is severe due to the potential for unauthorized access to sensitive data. An attacker exploiting this vulnerability could read files like /proc/1/environ, which contains environment variables. These variables often include critical secrets such as JWT (JSON Web Token) secrets, database credentials, encryption keys, and API tokens. Successful exploitation could lead to complete compromise of the Budibase instance, allowing the attacker to access and manipulate data, escalate privileges, and potentially pivot to other systems on the network. This vulnerability shares similarities with other path traversal exploits where unsanitized user input is used to construct file paths, leading to unintended file access.

Organizations using Budibase for internal tool development and deployment are at risk, particularly those with builder roles granted to multiple users. Shared hosting environments where multiple Budibase instances share the same server filesystem are especially vulnerable, as a compromise of one instance could lead to access to data from other instances. Legacy Budibase configurations with default or weak credentials also increase the risk.

• nodejs / server: Monitor logs for requests to /api/pwa/process-zip with unusual or unexpected file paths in the icons.json payload. Look for attempts to access files outside the expected directory.

grep -r 'path/outside/expected/directory' /var/log/budibase/*

• linux / server: Use lsof to monitor file access by the Budibase process. Look for access to sensitive files like /proc/1/environ.

lsof -p $(pgrep budibase) | grep /proc/1/environ

• generic web: Use curl to test the /api/pwa/process-zip endpoint with crafted icons.json payloads attempting to read arbitrary files. Check the response for file content.

curl -X POST -d '{"icons": [{"url": "/etc/passwd"}]}' http://<budibase_host>/api/pwa/process-zip

1. 2026-03-09Disclosure

   disclosure

1. Reservado2026-03-04
2. Publicada2026-03-09
3. Modificada2026-03-10
4. EPSS atualizado2026-03-23

The primary mitigation for CVE-2026-30240 is to upgrade Budibase to a version with the security patch. Consult the official Budibase advisory for the latest recommended version. If immediate upgrading is not possible, consider implementing temporary workarounds. While a direct WAF rule is difficult due to the nature of path traversal, strict input validation on the /api/pwa/process-zip endpoint is crucial. Monitor file system access logs for unusual activity. Review and restrict user privileges to minimize the potential impact of a successful attack. After upgrade, confirm the vulnerability is resolved by attempting to access a restricted file via the vulnerable endpoint and verifying access is denied.