CVE-2026-30240

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30240", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-04T17:23:59.799Z", "datePublished": "2026-03-09T20:50:09.129Z", "dateUpdated": "2026-03-10T15:22:48.070Z"}, "containers": {"cna": {"title": "Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-73", "lang": "en", "description": "CWE-73: External Control of File Name or Path", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Budibase/budibase/security/advisories/GHSA-pqcr-jmfv-c9cp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-pqcr-jmfv-c9cp"}], "affected": [{"vendor": "Budibase", "product": "budibase", "versions": [{"version": "<= 3.31.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-09T20:50:09.129Z"}, "descriptions": [{"lang": "en", "value": "Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.5 and earlier, a path traversal vulnerability in the PWA (Progressive Web App) ZIP processing endpoint (POST /api/pwa/process-zip) allows an authenticated user with builder privileges to read arbitrary files from the server filesystem, including /proc/1/environ which contains all environment variables \u2014 JWT secrets, database credentials, encryption keys, and API tokens. The server reads attacker-specified files via unsanitized path.join() with user-controlled input from icons.json inside the uploaded ZIP, then uploads the file contents to the object store (MinIO/S3) where they can be retrieved through signed URLs. This results in complete platform compromise as all cryptographic secrets and service credentials are exfiltrated in a single request."}], "source": {"advisory": "GHSA-pqcr-jmfv-c9cp", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/Budibase/budibase/security/advisories/GHSA-pqcr-jmfv-c9cp", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T15:22:39.774967Z", "id": "CVE-2026-30240", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T15:22:48.070Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30240", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-10T15:22:39.774967Z"}}}], "references": [{"url": "https://github.com/Budibase/budibase/security/advisories/GHSA-pqcr-jmfv-c9cp", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T15:22:28.927Z"}}], "cna": {"title": "Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets", "source": {"advisory": "GHSA-pqcr-jmfv-c9cp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Budibase", "product": "budibase", "versions": [{"status": "affected", "version": "<= 3.31.5"}]}], "references": [{"url": "https://github.com/Budibase/budibase/security/advisories/GHSA-pqcr-jmfv-c9cp", "name": "https://github.com/Budibase/budibase/security/advisories/GHSA-pqcr-jmfv-c9cp", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.5 and earlier, a path traversal vulnerability in the PWA (Progressive Web App) ZIP processing endpoint (POST /api/pwa/process-zip) allows an authenticated user with builder privileges to read arbitrary files from the server filesystem, including /proc/1/environ which contains all environment variables \u2014 JWT secrets, database credentials, encryption keys, and API tokens. The server reads attacker-specified files via unsanitized path.join() with user-controlled input from icons.json inside the uploaded ZIP, then uploads the file contents to the object store (MinIO/S3) where they can be retrieved through signed URLs. This results in complete platform compromise as all cryptographic secrets and service credentials are exfiltrated in a single request."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73: External Control of File Name or Path"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-09T20:50:09.129Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30240", "state": "PUBLISHED", "dateUpdated": "2026-03-10T15:22:48.070Z", "dateReserved": "2026-03-04T17:23:59.799Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-09T20:50:09.129Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "budibase", "vendor": "Budibase", "versions": [{"status": "affected", "version": "<= 3.31.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:*", "matchCriteriaId": "085377C0-B471-44F3-B3D5-15E66046E33B", "versionEndIncluding": "3.31.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.5 and earlier, a path traversal vulnerability in the PWA (Progressive Web App) ZIP processing endpoint (POST /api/pwa/process-zip) allows an authenticated user with builder privileges to read arbitrary files from the server filesystem, including /proc/1/environ which contains all environment variables \u2014 JWT secrets, database credentials, encryption keys, and API tokens. The server reads attacker-specified files via unsanitized path.join() with user-controlled input from icons.json inside the uploaded ZIP, then uploads the file contents to the object store (MinIO/S3) where they can be retrieved through signed URLs. This results in complete platform compromise as all cryptographic secrets and service credentials are exfiltrated in a single request."}, {"lang": "es", "value": "Budibase es una plataforma de bajo c\u00f3digo para crear herramientas internas, flujos de trabajo y paneles de administraci\u00f3n. En 3.31.5 y versiones anteriores, una vulnerabilidad de salto de ruta en el endpoint de procesamiento de ZIP de PWA (Progressive Web App) (POST /api/pwa/process-zip) permite a un usuario autenticado con privilegios de constructor leer archivos arbitrarios del sistema de archivos del servidor, incluido /proc/1/environ que contiene todas las variables de entorno \u2014 secretos JWT, credenciales de base de datos, claves de cifrado y tokens de API. El servidor lee archivos especificados por el atacante a trav\u00e9s de path.join() no saneado con entrada controlada por el usuario desde icons.json dentro del ZIP subido, luego sube el contenido del archivo al almac\u00e9n de objetos (MinIO/S3) donde pueden ser recuperados a trav\u00e9s de URLs firmadas. Esto resulta en un compromiso completo de la plataforma ya que todos los secretos criptogr\u00e1ficos y las credenciales de servicio son exfiltrados en una sola solicitud."}], "id": "CVE-2026-30240", "lastModified": "2026-06-17T10:32:32.927", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30240", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T15:22:39.774967Z", "version": "2.0.3"}}]}, "published": "2026-03-09T21:16:18.843", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-pqcr-jmfv-c9cp"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-pqcr-jmfv-c9cp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-73"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.31.5]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "budibase", "source": "cna", "vendor": "Budibase"}, "product": "budibase", "vendor": "budibase"}], "analysis": {"en": {"generated_at": "2026-04-16T10:12:27.456874+00:00", "value": {"mitigation_remediation": ["Apply the latest Budibase update that patches the PWA ZIP processing endpoint and prevents unsanitized path traversal.", "Revoke all JWT tokens and regenerate any environment secrets that were exposed through the vulnerability.", "Delete any files that have been uploaded to the object store via the vulnerable endpoint and perform a security audit of the stored data.", "If an immediate upgrade is not possible, disable builder privileges for all users and block access to the /api/pwa/process-zip endpoint until the patch is applied."], "summary": {"action": "Immediate patch", "impact": "Secret disclosure and complete platform compromise via arbitrary file read"}, "threat_synthesis": {"affected_systems": "The affected product is Budibase, the low\u2011code platform for internal tools, workflows, and admin panels. All installations running version\u202f3.31.5 and earlier are vulnerable. No further version details are provided in the advisory.", "description_and_impact": "In Budibase versions 3.31.5 and earlier, an authenticated user with builder privileges can upload a specially crafted ZIP file to the PWA processing endpoint. The server unsafely evaluates file paths extracted from the ZIP, allowing the attacker to read any file on the filesystem, including sensitive environment variables such as JWT secrets and database credentials. The extracted file contents are then stored in an object store where they can be retrieved through signed URLs, resulting in the exfiltration of cryptographic secrets and service tokens in a single request. The vulnerability constitutes a high\u2011severity file\u2011reading flaw that can fully compromise the platform.", "risk_and_exploitability": "The CVSS score of 9.6 indicates a critical impact. The EPSS score is less than 1\u202f%, suggesting a low probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. The attack requires the attacker to have authenticated builder privileges and to upload a ZIP file to the /api/pwa/process-zip endpoint. Once exploited, the attacker can read arbitrary files and exfiltrate secrets, effectively compromising the entire Budibase deployment."}}}}, "created": "2026-03-10T14:07:05.375554+00:00", "updated": "2026-04-16T10:15:26.113796+00:00", "vendors": ["budibase", "budibase$PRODUCT$budibase"]}