{"id":"EUVD-2026-18793","revision":"66d99aae0783480d9248201e2bc60885","records":[{"revision":"66d99aae0783480d9248201e2bc60885","observedAt":"2026-11-03T07:02:50.056+00:00","statement":{"source":"euvd","id":"EUVD-2026-18793","aliases":["CVE-2026-35214","GHSA-2wfh-rcwf-wh23"],"title":"Budibase is an open-source low-code platform. Prior to version 3.33.4, the plugin file upload endpoint (POST /api/plugin/upload) passes the user-supplied filename directly to createTempFolder() without sanitizing path traversal sequences. A…","description":"Budibase is an open-source low-code platform. Prior to version 3.33.4, the plugin file upload endpoint (POST /api/plugin/upload) passes the user-supplied filename directly to createTempFolder() without sanitizing path traversal sequences. An attacker with Global Builder privileges can craft a multipart upload with a filename containing ../ to delete arbitrary directories via rmSync and write arbitrary files via tarball extraction to any filesystem path the Node.js process can access. This issue has been patched in version 3.33.4.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H","score":8.7,"severity":null}],"references":["https://github.com/Budibase/budibase/security/advisories/GHSA-2wfh-rcwf-wh23","https://github.com/Budibase/budibase/pull/18240","https://github.com/Budibase/budibase/commit/6344d06d703660fd05995e61d581593c2349c879","https://github.com/Budibase/budibase/releases/tag/3.33.4"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-18793","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 3, 2026, 3:43:12 PM","dateUpdated":"Apr 3, 2026, 4:04:36 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-18793","identifiers":["EUVD-2026-18793","CVE-2026-35214","GHSA-2wfh-rcwf-wh23"]},"retained":false,"historicalAffected":[]}],"coverage":[]}