CVE-2026-35214

Budibase is an open-source low-code platform. Prior to version 3.33.4, the plugin file upload endpoint (POST /api/plugin/upload) passes the user-supplied filename directly to createTempFolder() without sanitizing path traversal sequences. An attacker with Global Builder privileges can craft a multipart upload with a filename containing ../ to delete arbitrary directories via rmSync and write arbitrary files via tarball extraction to any filesystem path the Node.js process can access. This issue has been patched in version 3.33.4.

• CWE-22

• https://github.com/Budibase/budibase/commit/6344d06d703660fd05995e61d581593c2349c879Patch
• https://github.com/Budibase/budibase/pull/18240Issue Tracking, Patch
• https://github.com/Budibase/budibase/releases/tag/3.33.4Product, Release Notes
• https://github.com/Budibase/budibase/security/advisories/GHSA-2wfh-rcwf-wh23Exploit, Mitigation, Vendor Advisory
• https://github.com/Budibase/budibase/security/advisories/GHSA-2wfh-rcwf-wh23Exploit, Mitigation, Vendor Advisory

Published

Apr 3, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35208lichess.org is the forever free, adless and open source ches…5.4
• CVE-2026-35209defu is software that allows uers to assign default properti…7.5
• CVE-2026-35210OpenCTI is an open source platform for managing cyber threat…7.1
• CVE-2026-35211OpenCTI is an open source platform for managing cyber threat…6.5
• CVE-2026-35212OpenCTI is an open source platform for managing cyber threat…6.1
• CVE-2026-35213@hapi/content provided HTTP Content-* headers parsing. All v…7.5
• CVE-2026-35215Firebird is an open-source relational database management sy…7.5
• CVE-2026-35216Budibase is an open-source low-code platform. Prior to versi…9
• CVE-2026-35217NanoMQ contains a protocol-semantics flaw in its MQTT v5 `SU…6.5
• CVE-2026-35218Budibase is an open-source low-code platform. Prior to versi…8.7
• CVE-2026-35220Lack of CSRF token validation lead to a CSRF attack vector i…4.3
• CVE-2026-35221Improperly built filter clauses lead to a SQL injection vuln…9.8