Budibase is an open-source low-code platform. Prior to 3.39.9, `POST /api/pwa/process-zip` at packages/server/src/api/routes/static.ts:24 accepts a builder-uploaded .zip, extracts it with extract-zip@2.0.1 into a temp directory, then for each entry listed in icons.json validates the icon path, opens it, and streams the bytes into MinIO. The resulting object is served back via GET /api/assets/{appId}/pwa/{uuid}.png. extract-zip@2.0.1 preserves absolute symlink targets when restoring symlink entries. The icon-source validator at packages/server/src/api/controllers/static/index.ts:259-268 resolves the icon source string against baseDir (path.resolve), checks resolvedSrc.startsWith(baseDir + path.sep) against that string, and calls fs.existsSync(resolvedSrc) which follows symbolic links to confirm the target exists. None of the three calls reject symbolic-link entries. packages/backend-core/src/objectStore/objectStore.ts:302 then calls (await fsp.open(path)).createReadStream() on the resolved path. fsp.open follows the symlink, the target file's bytes stream into MinIO, and the response of the asset-fetch endpoint returns those bytes verbatim. Result: a workspace-level builder reads any file the server process can open. This vulnerability is fixed in 3.39.9.
The `POST /api/pwa/process-zip` endpoint accepts a ZIP archive uploaded by a builder and extracts it to a temporary directory using the extract-zip@2.0.1 library, which preserves absolute symlink targets. The icon path validator checks if the path starts with the expected base directory but does not reject entries that are symlinks — calling `fs.existsSync()` follows the symlink, confirming its existence. Subsequently, `fsp.open()` opens the file through the symlink and streams its content directly to MinIO. The object stored this way is then served by the `GET /api/assets/{appId}/pwa/{uuid}.png` endpoint, returning the bytes of the target file directly to the attacker.
An attacker with builder permissions at the workspace level can read any file accessible to the server process, including configuration files, secrets, private keys, or other sensitive system data.
Update Budibase to version 3.39.9 or later, where the vulnerability has been fixed. Details are available in the official security advisory from the vendor at https://github.com/Budibase/budibase/security/advisories/GHSA-w7mq-r738-x278.
Budibase versions before 3.39.9 (open-source low-code platform).
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:NBudibase
APPBudibase< 3.39.9
Related vulnerabilities
SQL/NoSQL Injection w Budibase — nieautoryzowany odczyt i zapis danych
Budibase: pominięcie uwierzytelnienia przez manipulację query string
SSRF w Budibase — nieaktywna ochrona blacklisty IP umożliwia dowolne żądania
Budibase: nieuwierzytelniony RCE przez publiczny webhook i krok Bash
Path Traversal w Budibase — odczyt dowolnych plików przez endpoint PWA ZIP