External risk intelligence

Budibase Arbitrary File Write via Path Traversal

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-72850

Budibase is a low-code platform that may be deployed in various environments. While the application itself can be network-accessible, this vulnerability requires an authenticated builder role to exploit, which is typically restricted to authorized internal users or developers rather than being a public-facing unauthenticated endpoint.

Path Traversal

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in Budibase, a low-code platform, that could allow authenticated users to write arbitrary content to any file on the server. The issue stems from improper sanitization of S3 object keys during workspace exports, enabling file traversal.

Authenticated users can write anywhere on the server.
Important for verifying if internal developers use this platform.
Confirm relevance and assess potential exposure to this risk.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access to Budibase can craft malicious filenames during a workspace export. These specially formed names, containing traversal sequences, can bypass intended directory restrictions, enabling the attacker to overwrite arbitrary files on the server where Budibase is running. This capability, when supported by the environment, could lead to significant system compromise.

Requires authenticated builder access.
Triggers during workspace export with crafted filenames.
Allows arbitrary file writes.

Live Threat

Current exploitation, exposure, and threat context

Budibase, when used by authenticated builders, could allow for arbitrary file writes on the server hosting the Budibase application during workspace exports. This occurs because the system fails to properly sanitize S3 object keys, enabling traversal sequences in filenames to write content to any location the Budibase process has permission to write to.

System files could be overwritten.
Traversal sequences in filenames enable writes.
Disruption of Budibase service operations.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Budibase application owner is responsible for addressing this vulnerability. The first practical step is to identify all Budibase instances, confirm their reachability and business criticality, and then plan remediation, potentially coordinating with vendor management if a managed service is in use.

Identify Budibase instances and owners.
Verify reachability and business impact.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Budibase and how is it used?

Budibase is a low-code platform designed for building internal business applications, automation tools, and admin panels. Developers and teams use it to rapidly connect to data sources, create user interfaces, and manage workflows within their organization's infrastructure.

What is the vulnerability behind CVE-2026-72850?

The vulnerability is a path traversal flaw, identified as CWE-22. It happens when the software fails to clean input for S3 object keys. Because these filenames are not properly sanitized, a user can insert special '..' sequences to escape the intended directory and save files to unintended locations on the server.

How can an attacker trigger this Budibase flaw?

An attacker triggers this by having authenticated builder access to the platform. They must initiate a workspace export while using specifically crafted filenames that include traversal characters. Simply accessing the application or viewing data without performing an export operation does not trigger the file write.

Is my Budibase instance at risk?

According to Halo Surface Signal, this risk is currently classified as unlikely because the exploit requires an authenticated builder role. While the application may be network-accessible, the need for valid builder credentials typically limits the risk to authorized internal users rather than anonymous public traffic.

How do I respond to this vulnerability?

Begin by auditing your environment to identify all active Budibase instances and their specific owners. Verify if these instances are accessible over the network and assess their business importance. Once mapped, coordinate with your technical teams or vendor management to plan and apply the necessary version updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.