CVE-2026-100682

Executive Summary

CVE-2026-100682 is an arbitrary file write vulnerability in the Budibase Server PWA icon upload endpoint, affecting all versions before 3.45.0. An authenticated attacker holding the BUILDER role can upload a crafted ZIP archive that abuses insufficient symlink validation during extraction, allowing files to be written as root and enabling remote code execution. With a CVSS base score of 8.8, the flaw carries high confidentiality, integrity, and availability impact and requires only low privileges with no user interaction.

Technical Analysis

The vulnerability resides in the PWA (Progressive Web App) icon upload functionality of Budibase Server. According to the NVD description, the endpoint extracts user-supplied ZIP archives "without proper symlink validation." The core defect maps to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, commonly known as Path Traversal), which in this context manifests as an archive-extraction path-traversal / symlink-following condition (often categorized as "Zip Slip" when combined with symlink abuse).

The attack mechanism described is specific and notable:

1. The attacker supplies a ZIP archive containing leaf symlink entries — symlink entries positioned at the end of the archive's entry list (leaf nodes), as opposed to symlinks that point to other archive entries.
2. These symlink entries are followed by duplicate file entries. Because ZIP archives permit multiple entries with identical names, extraction logic that does not detect or reject duplicates will process the later entry after the symlink has already been materialized on disk.
3. The pre-existing symlink redirects the write target of the duplicate file entry to an attacker-chosen location outside the intended extraction directory.
4. Because the extraction process runs with elevated privileges, the file is written as root, enabling arbitrary file write at privileged locations.

This combination — symlink creation followed by duplicate-name file writes — defeats naive "extract to a temp directory then validate" defenses that only inspect names once or that do not resolve symlinks before writing. The endpoint is reachable by any authenticated principal with the BUILDER role, meaning the barrier to exploitation is a valid low-privilege account rather than administrative access.

No public proof-of-concept, Nuclei template, or exploit code is available as of this report; the technical description above is derived directly from the NVD entry. The CVE has not been added to CISA KEV and has no EPSS score from FIRST.org at time of writing. No CVE description references specific function names, class names, or file paths beyond "PWA icon upload endpoint," and none are asserted here.

Exploitation Scenarios

The following attack chain is reconstructed strictly from the vulnerability class and the NVD description. No public PoC exists; where the description does not specify implementation detail, the sequence is described at the vulnerability-class level.

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-exposed Budibase Server instance running a version below 3.45.0. Because Budibase is a low-code application development platform, its administrative and builder interfaces are frequently exposed to enable remote authoring, making discovery viable through standard web fingerprinting.

2. Prerequisite access. The attacker must first obtain a valid account with the BUILDER role. This may be achieved through legitimate provisioning, a weak or reused credential, or a separate compromise. The CVSS vector (PR:L) confirms low privileges are sufficient — no administrative role is required.

3. Triggering the flaw. Once authenticated as a BUILDER, the attacker accesses the PWA icon upload endpoint and submits a malicious ZIP archive. The archive is structured with a leaf symlink entry pointing to an attacker-chosen target path, followed by a duplicate file entry whose name collides with the symlink. The extraction routine materializes the symlink and then the duplicate write follows it, writing attacker-controlled content to an arbitrary location as root.

4. Payload / execution method. The arbitrary write delivers attacker-controlled content to a privileged filesystem location. Depending on the target path selected, this can result in remote code execution — for example, by overwriting a file that is subsequently executed or sourced by a privileged process. The NVD description explicitly states the flaw enables RCE, but does not name specific target files; accordingly, no specific paths are asserted here.

5. Post-exploitation impact. Successful exploitation yields root-level file write and, as described, code execution. From there, an attacker could establish persistence, exfiltrate data, pivot into connected systems, or tamper with application logic and secrets managed by the platform.

No exploit-in-the-wild evidence, threat actor attribution, or campaign reporting is available for this CVE at time of writing.

Impact Assessment

The CVSS 3.1 base score is 8.8 (High) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Interpretation of the subscores:

• Attack Vector (N — Network): Exploitation is possible remotely over the network; physical or adjacent access is not required.
• Attack Complexity (L — Low): No special conditions or race windows are needed beyond crafting the archive; the technique is deterministic given the described duplication trick.
• Privileges Required (L — Low): Only a BUILDER-role account is needed, lowering the bar for an external attacker who can obtain or register such an account.
• User Interaction (N — None): No victim action is required; the attacker triggers extraction directly.
• Scope (U — Unchanged): The impacting component and impacted component are the same.
• Confidentiality / Integrity / Availability (H/H/H): All three are rated High. Arbitrary root-level file write can expose sensitive data, corrupt or replace application and system files, and render services unavailable.

Blast radius. Budibase is a self-hosted and cloud-deployable low-code platform, so a compromised instance may hold application data, integration credentials, and connections to downstream databases and APIs. A root-level write thus extends impact well beyond the Budibase application to the host and anything reachable through stored credentials. Organizations running Budibase with builder access granted to a broad user base face the widest exposure.

Detection Guidance

Sigma Rule

title: Budibase PWA Icon Upload ZIP Symlink/Path Traversal Exploitation Attempt
id: 8f5c1a2e-4b7d-4c9a-9e21-6d3f0a9c1b77
status: experimental
description: Detects uploads of ZIP archives to the Budibase PWA icon upload endpoint that may exploit CVE-2026-100682 via symlink and duplicate-entry abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100682
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/pwa'
      - '/icon'
    cs-method: 'POST'
  selection_zip:
    cs-uri-query|contains: 'zip'
    cs-content-type|contains: 'multipart/form-data'
  condition: selection_endpoint and selection_zip
falsepositives:
  - Legitimate PWA icon uploads by builders
level: medium
tags:
  - attack.t1190
  - cve.2026-100682

YARA Rule

rule CVE_2026_100682_Budibase_ZipSymlink
{
    meta:
        description = "Detects ZIP archives crafted for CVE-2026-100682 symlink/duplicate-entry abuse against Budibase"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100682"
    strings:
        $pk = { 50 4B 03 04 }
        $symlink = { 41 00 1F 00 }  // UNIX symlink external attributes marker (A1FF) heuristic
        $traversal = "../" ascii wide
    condition:
        $pk at 0 and $traversal and #pk > 3
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100682 Budibase PWA icon upload ZIP traversal attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/pwa"; nocase; http.uri; content:"icon"; nocase; http.content_type; content:"multipart/form-data"; file_data; content:"PK"; depth:2; content:"../"; within:4096; reference:cve,2026-100682; classtype:web-application-attack; sid:2026100682; rev:1;)

Elastic Detection

sequence by user.name with maxspan=1m
  [ http.request where http.request.method == "POST" and
      http.request.body.content : "*PK*" and
      http.request.body.content : "*../*" and
      (http.request.uri : "*pwa*" or http.request.uri : "*icon*") ]
| keep user.name, source.ip, http.request.uri, host.name

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=*proxy*
(http.url="*pwa*" OR http.url="*icon*") method="POST"
| where match(_raw, "PK") OR match(body, "PK")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, http.url, user
| where count >= 1

Wazuh OSSEC Rule

<group name="web,budibase,">
  <rule id="100682" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>CVE-2026-100682</match>
    <description>Potential Budibase PWA icon upload exploit attempt (CVE-2026-100682) - possible ZIP symlink/path traversal.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_100682,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source; no vendor fix confirmation or workaround published in the data provided).

1. Immediate mitigations (no patch available):

   • Restrict access to the PWA icon upload endpoint to trusted networks via reverse proxy or firewall rules where feasible.
   • Reduce the number of accounts holding the BUILDER role; enforce least privilege and strong authentication (including MFA) on builder accounts.
   • Block ZIP uploads to the PWA icon endpoint at the WAF or reverse proxy if the legitimate use case does not require them.
   • Run the Budibase service under a low-privilege service account rather than root to limit the impact of arbitrary file writes.
   • Apply filesystem monitoring to detect unexpected writes by the Budibase process outside intended directories.

2. Patch / upgrade steps:

   • Upgrade Budibase Server to 3.45.0 or later, which is the fix version identified by the NVD description.
   • Verify the upgrade through the vendor's official release channel before deployment, since no tracked patch source currently confirms the fix.
   • After upgrading, re-test the PWA icon upload function to confirm the symlink/duplicate-entry extraction flaw is remediated.

3. Long-term hardening:

   • Harden archive extraction logic generally: resolve and reject symlink entries, reject duplicate entry names, and canonicalize paths before writing so writes cannot escape the intended directory.
   • Enforce never running application services as root.
   • Adopt a vulnerability management process that tracks Budibase releases and subscribes to its security advisories.
   • Monitor builder-role activity for anomalous upload patterns via the detection rules above.

References

• NVD — CVE-2026-100682: https://nvd.nist.gov/vuln/detail/CVE-2026-100682
• MITRE CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• Budibase official project/release channel (verify fix version 3.45.0): https://github.com/Budibase/budibase
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA KEV Catalog (CVE-2026-100682 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are known for this CVE at time of writing.