Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2026-100680

Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to read arbitrary local files. Attackers with builder access can embed file:// references in OpenAPI specifications submitted to the import endpoint to exfiltrate sensitive files including environment variables containing JWT secrets, API keys, and database credentials.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

budibase server

Default version status: unaffected

  • 0 to < 3.45.0affected
  • 3.45.0unaffected
pkg:npm/%40budibase/server

References