Threat Intelligence Report: CVE-2026-72850

Executive Summary

CVE-2026-72850 is a path traversal vulnerability (CWE-22) in Budibase, an open-source low-code development platform, affecting all versions prior to 3.40.0. The flaw resides in insufficient sanitization of S3 object keys during workspace exports, allowing authenticated builders with high privileges to write arbitrary files to any path writable by the Budibase process. With a CVSS score of 9.1 and a scope change indicating cross-system impact, this vulnerability presents a severe risk to organizations running self-hosted Budibase instances.

Technical Analysis

Vulnerability Class: Path Traversal (CWE-22)

Affected Component: S3 object key handling during workspace export functionality in Budibase.

Root Cause: The Budibase application fails to properly sanitize S3 object keys before they are used during workspace export operations. S3 object keys serve as identifiers for objects within an S3 bucket, and when these keys contain traversal sequences (e.g., ../ or ..\\), they can be manipulated to escape the intended temporary export directory.

Attack Mechanism: An authenticated builder (a user with elevated permissions to create and modify application workspaces) uploads files to the platform. These files are stored in an S3-compatible storage backend with object keys that the user can influence. When a workspace export operation is triggered, the application processes these object keys to retrieve and copy the files to a temporary directory before packaging them for export. Because the object keys are not sanitized, filenames containing traversal sequences (e.g., ../../etc/cron.d/backdoor) cause the application to resolve paths outside the intended temporary export directory.

Key Technical Details from NVD Description:

• The vulnerability is present in Budibase versions before 3.40.0
• Attackers must be authenticated builders — this requires valid credentials with builder-level permissions
• The flaw involves S3 object keys containing traversal sequences
• The traversal sequences are preserved during export, meaning the application does not normalize or strip these sequences when processing the object keys
• Successful exploitation allows writing arbitrary content to any path writable by the Budibase process

Attack Surface: The vulnerability is exposed through the workspace export functionality, which is a standard feature in Budibase used to export application configurations, design elements, and associated files. The export process accesses S3-backed storage to retrieve files that are part of the workspace.

CVSS Analysis:

• Attack Vector: Network (AV:N) — Exploitable remotely over the network
• Attack Complexity: Low (AC:L) — No special conditions required beyond authentication
• Privileges Required: High (PR:H) — Requires authenticated builder access
• User Interaction: None (UI:N) — No victim interaction needed
• Scope: Changed (S:C) — The compromised component (Budibase application) impacts resources beyond its security scope (the underlying file system)
• Confidentiality, Integrity, Availability Impact: High (C:H/I:H/A:H) — Complete compromise of system data, integrity, and availability

Insufficient Technical Detail: The NVD description does not specify the exact S3 client library used, the precise export code path, or the specific Budibase modules responsible for this vulnerability. Insufficient technical detail is available to identify exact function names or API endpoints involved in the flawed sanitization logic.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and NVD description.

Scenario 1: Full System Compromise via File Write

Step 1 — Reconnaissance/Target Identification: An attacker identifies a self-hosted Budibase instance (version < 3.40.0) through internet-wide scanning for Budibase login portals, administrative interfaces, or API endpoints. The attacker validates the version through HTTP headers, fingerprinting, or version disclosure in application responses.

Step 2 — Triggering the Flaw: The attacker authenticates as a builder (either through valid credentials obtained via phishing, credential stuffing, or legitimate access from a compromised account). Once authenticated, the attacker creates or modifies a workspace and uploads files designed to influence S3 object keys. The attacker crafts filenames containing traversal sequences such as:

• ../../../../etc/cron.d/persistent_backdoor
• ../../../opt/budibase/apps/ directory structures

The attacker must ensure the traversal depth is sufficient to escape the temporary export directory to reach the desired target location.

Step 3 — Payload Execution: The attacker initiates a workspace export to trigger the vulnerable code path. The application processes the malicious object keys, and because sanitization is inadequate, the export routine writes file contents to the attacker-specified absolute path. The payload content written could include:

• Cron job definitions for persistent execution (e.g., reverse shell scripts)
• SSH authorized_keys entries for persistent remote access
• Web shell files within the Budibase web root (if accessible)
• Application configuration files to enumerate credentials or modify application behavior

Step 4 — Post-Exploitation Impact: Depending on the privileges of the Budibase process (typically running as a service account), the attacker achieves code execution in the context of the Budibase service. This can lead to:

• Lateral movement within the hosting environment
• Data exfiltration from connected databases and other services
• Deployment of rootkits or persistence mechanisms
• Complete compromise of the Budibase instance and potentially the underlying host

Scenario 2: Data Integrity Manipulation

Step 1—3: Similar to Scenario 1, the attacker uploads files with traversal sequences targeting Budibase application files, template directories, or configuration paths storing core application logic.

Step 4: By overwriting application templates, configuration files, or exported package content, the attacker can:

• Inject malicious JavaScript into exported application packages distributed to other Budibase users
• Modify authentication/authorization configuration to escalate privileges for other accounts
• Corrupt application logic to deceive other builders or end-users

Scenario 3: Availability Disruption

Step 1—3: The attacker targets critical system files (e.g., systemd unit files, binary paths, or library files) with arbitrary content to disrupt service operations.

Step 4: Writing malformed or invalid content to critical system paths causes the Budibase service to fail on restart or during normal operation, resulting in denial of service.

Impact Assessment

Business Impact:

The CVSS score of 9.1 places this vulnerability in the Critical severity range. The high confidentiality, integrity, and availability impact scores indicate that successful exploitation results in complete compromise of the affected system.

Affected Systems:

• All self-hosted Budibase deployments running versions prior to 3.40.0
• Cloud-hosted Budibase instances where S3-compatible storage is integrated
• Organizations using Budibase for internal tool building with multiple builder accounts

Blast Radius:

• Direct: The Budibase application and its host operating system
• Indirect: Connected database systems (Budibase typically integrates with PostgreSQL, MySQL, SQL Server), S3 buckets, and any services accessible from the compromised host
• Organizational: For organizations that use Budibase to expose internal tools to production, the risk of cascading compromise is elevated

Authentication Barrier: The requirement for builder-level authentication (PR:H) reduces the attack surface to authenticated users. This is partially mitigated by the fact that in many organizations, builders are trusted administrators. However, the integrity of the threat model is compromised by:

• Credential theft via phishing or credential stuffing attacks
• Insider threats
• Compromised third-party developer accounts

Detection Guidance

Sigma Rule

title: Budibase S3 Path Traversal Upload Attempt
id: 9e70a8de-4b1f-4a3e-8c5c-2f1b9d3e7a21
status: experimental
description: Detects attempts to upload files with path traversal sequences in S3 object keys to Budibase instances (CVE-2026-72850)
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-72850
author: Valters It Security
date: 2026/02/15
logsource:
    category: application
    product: budibase
detection:
    selection_traversal:
        - fields:
            - 'object_key'
            - 'file_name'
            - 'filename'
          contains:
            - '..%2f'
            - '..%5c'
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
    selection_s3_operation:
        fields:
            - operation
            - action
        contains:
            - 'upload'
            - 'put_object'
            - 'export'
    selection_auth:
        fields:
            - auth.roles
            - permissions
    condition: selection_s3_operation and selection_traversal
falsepositives:
    - Legitimate users with filenames that happen to contain dot sequences (rare)
level: high
tags:
    - attack.t1190
    - cve.2026.72850
    - cwe.22
    - mitre.t1190

YARA Rule

rule CVE_2026_72850_Budibase_PathTraversal
{
    meta:
        author = "Valters IT Security"
        description = "Detects path traversal patterns in Budibase S3 object keys and file upload requests"
        date = "2026-02-15"
        cve = "CVE-2026-72850"
        severity = "high"
        tags = ["cwe-22", "path-traversal", "budibase"]

    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e%5c"
        $traversal5 = "..%2f"
        $traversal6 = "..%5c"
        $s3_key = "key="
        $export_op = "export"
        $upload_op = "upload"
        $s3_put = "PutObject"
        $s3_post = "PostObject"

    condition:
        any of ($traversal*) and (
            any of ($s3_key, $s3_put, $s3_post) or
            any of ($export_op, $upload_op)
        )
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-72850 Budibase Path Traversal in S3 Object Key";
    content:"POST"; http_method;
    content:"/upload"; http_uri;
    content:"key="; http_client_body;
    pcre:"/key=[a-zA-Z0-9_\-\.\/]*(\x2e\x2e\x2f|\x2e\x2e\x5c|\.\.\/|\.\.\\)/i";
    classtype:attempted-admin;
    reference:cve,2026-72850;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2026-72850;
    sid:2026021501;
    rev:1;
    metadata:impact severity high, mitre_tactic T1190;
)

alert http any any -> any any (
    msg:"CVE-2026-72850 Budibase Export with Traversal Sequence in Filename";
    content:"POST"; http_method;
    content:"/export"; http_uri;
    pcre:"/filename=[a-zA-Z0-9_\-\.]*(\x2e\x2e\x2f|\x2e\x2e\x5c|\.\.\/|\.\.\\)/i";
    classtype:attempted-admin;
    reference:cve,2026-72850;
    sid:2026021502;
    rev:1;
    metadata:impact severity high, mitre_tactic T1190;
)

Elastic Detection

// Detect suspicious S3 key patterns in Budibase application logs
sequence by host.name with maxspan=5m
  [authentication where process.name == "budibase" and event.type in ("start","info")]
  [file where process.name == "budibase"
   and event.type == "creation"
   and (file.name : "*.%2e%2e*" or file.name : "*\..\..\*" or file.name : "../*")
   and file.path : "*export*"]
   
// Alternative: detect file writes outside temp directory during export operation
any where process.name == "budibase"
  and event.module == "file"
  and event.action in ("write", "create")
  and file.path : "*" 
  and not file.path : "*/tmp/*"
  and file.path : "*/budibase/export*"

Splunk SPL Query

index=budge OR index=main sourcetype=budibase* 
| search "export" 
| regex _raw="(\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e%5c|\.\.%2f|\.\.%5c)"
| eval suspicious=true
| table _time, host, src_ip, user, action, object_key, file_name, path
| sort - _time

| eventstats count as exploit_attempts by host
| where exploit_attempts > 3
| rex field=_raw "key=(?<object_key>[^&\s]+)"
| rex field=_raw "filename=(?<file_name>[^&\s]+)"
| rex field=_raw "path=(?<target_path>[^&\s]+)"
| eval traversal_detected = if(match(object_key, "\.\./") OR match(object_key, "\.\.\\") OR match(object_key, "%2e%2e%2f") OR match(file_name, "\.\./") OR match(file_name, "\.\.\\"), "YES", "NO")
| where traversal_detected == "YES"

Wazuh OSSEC Rule

<group name="budibase, cve-2026-72850">

  <rule id="100850" level="12">
    <decoded_as>json</decoded_as>
    <field name="log_type">budibase</field>
    <regex>(\x2e\x2e\x2f|\x2e\x2e\x5c|\.\.\/|\.\.\\)</regex>
    <description>Budibase CVE-2026-72850: Path traversal sequence detected in S3 object key or file name</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack.t1190, cwe-22</group>
    <options>no_full_log</options>
  </rule>

  <rule id="100851" level="15">
    <if_sid>100850</if_sid>
    <field name="event_type">export</field>
    <description>Budibase CVE-2026-72850: Path traversal during workspace export - potential arbitrary file write</description>
    <group>attenuated_risk</group>
  </rule>

  <rule id="100852" level="15">
    <if_sid>100850</if_sid>
    <field name="event_type">upload</field>
    <description>Budibase CVE-2026-72850: Path traversal in file upload - malicious S3 object key</description>
    <group>attenuated_risk</group>
  </rule>

</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED (No patch evidence from any tracked source)

Immediate Mitigations (No Patch Available)

1. Restrict Builder Access: Limit the number of authenticated users with builder-level permissions to the minimum required for business operations. Audit all existing builder accounts and remove inactive or unnecessary accounts.

2. Principle of Least Privilege: Ensure the Budibase process runs with the minimum required operating system privileges. Run the service as a dedicated non-root user with restricted filesystem write permissions, specifically limiting write access to only the application data directory.

3. Network Segmentation: Isolate Budibase instances within a segmented network zone. Implement strict egress firewall rules to prevent lateral movement if the host is compromised.

4. Monitor Export Activity: Deploy the detection rules provided above and enable logging for all export and upload operations. Review logs regularly for anomalous file path patterns.

5. Disable or Restrict Export Functionality: If workspace export is not essential, consider disabling the export feature or restricting it to only the most trusted administrators with manual approval workflows.

6. Rate Limiting: Implement rate limiting on upload and export endpoints to slow down automated exploitation attempts.

Patch/Upgrade Steps

1. Monitor for Patch Release: Budibase has not yet released a public patch at the time of this report. Subscribe to Budibase security advisories and monitor their official GitHub repository (github.com/Budibase/budibase) for a security release.

2. Upgrade to 3.40.0 or later: Once the fixed version becomes available, upgrade all affected Budibase instances to version 3.40.0 or the latest patched release. Test the upgrade in a staging environment before applying to production.

3. Verify Integrity: After upgrading, verify the integrity of the installation by checking file hashes and confirming that no unauthorized modifications were made to Budibase application files during the vulnerable period.

Long-Term Hardening

1. Input Validation: Ensure robust input validation for all file uploads and S3 object key generation. Implement allowlisting for allowed characters in filenames, rejecting dot-dot sequences and path separators.

2. Secure Storage Configuration: Configure S3 bucket policies to enforce key restrictions and enable S3 object key versioning to support forensic analysis.

3. Filesystem Controls: Deploy filesystem-level controls such as:

   • Read-Only mounts for non-writable directories
   • SELinux/AppArmor profiles to constrain the Budibase process
   • chroot/jail environments to contain file system access

4. Application Security Review: Conduct a thorough security review of the Budibase codebase to identify other potential traversal or sanitization issues. Engage the community or a third-party security firm for penetration testing.

5. Credential Hygiene: Implement multi-factor authentication (MFA) for all Budibase accounts, especially those with builder-level privileges. Enforce strong password policies and periodic credential rotation.

6. Backup and Recovery: Maintain regular encrypted backups of Budibase data, including database snapshots and application configuration files. Test recovery procedures to ensure rapid restoration in case of compromise.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72850
2. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/
3. CWE-22 (Path Traversal): https://cwe.mitre.org/data/definitions/22.html
4. Budibase Official Repository (for patch monitoring): https://github.com/Budibase/budibase
5. CVSS Calculator Reference: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Known Threat Actor Campaigns: No threat actor campaigns or exploit-in-the-wild evidence has been publicly documented for CVE-2026-72850 as of this report. However, similar path traversal vulnerabilities in low-code/rapid application development platforms have been actively targeted by APT groups seeking to compromise internal developer tools and pivot into backend infrastructure.

CISA KEV Status: Not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog at the time of this report.

Report prepared by Valters IT Security Threat Intelligence Team — 2026 Classification: Controlled Unclassified Information (CUI)