Description
Budibase is an open-source low-code platform. Prior to version 3.33.4, the plugin file upload endpoint (POST /api/plugin/upload) passes the user-supplied filename directly to createTempFolder() without sanitizing path traversal sequences. An attacker with Global Builder privileges can craft a multipart upload with a filename containing ../ to delete arbitrary directories via rmSync and write arbitrary files via tarball extraction to any filesystem path the Node.js process can access. This issue has been patched in version 3.33.4.
INFO
Published Date :
2026-04-03T15:43:12.426Z
Last Modified :
2026-04-03T16:04:36.168Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2026-35214 vulnerability.
| Vendors | Products |
|---|---|
| Budibase |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-35214.
