CVE-2026-72850

CVE-2026-72850 is a path traversal in Budibase's S3 export functionality that allows authenticated builders to write arbitrary files to the host filesystem. The technical mechanism is straightforward—insufficient sanitization of S3 object keys—but the security failure runs deeper than the code bug. This vulnerability exists because Budibase's permission model never treated filesystem access through platform features as a privilege boundary. Export operations sit in a security dead zone across most platforms: they read data and package it for retrieval, so the implicit assumption is that exports cannot cause harm. CVE-2026-72850 breaks that assumption by making the export process itself a write vector. A builder with valid credentials can escalate to writing anywhere the Budibase process account can write—privilege escalation that exploits the gap between what the platform thinks builders can do (create applications) and what the underlying process can actually do (write arbitrary paths). The fix applied to the S3 object key handling will patch the symptom, but the architectural problem remains. Low-code platforms normalize giving developers broad capabilities for productivity—this is the value proposition. But if filesystem access through platform features was never modeled as a capability requiring explicit authorization, similar vulnerabilities will emerge as new integrations are added. Every external resource access through platform features should be treated as a security boundary equivalent to application logic execution, not as an implementation detail delegated to the engineering team building that feature. The EPSS score of 0.00422 indicates this isn't being commoditized at scale yet, likely because exploitation requires an already-compromised builder account. However, the CVSS 9.1 rating reflects the genuine severity: once inside the builder tier, an attacker gains filesystem write access that the permission model never intended to grant. In PaaS deployments where Budibase runs as a shared process, one builder's traversal affects paths accessible to all tenants on that host—a blast radius that single-tenant installations don't face. Audit your deployment for the S3 export capability. If Budibase runs in a multi-tenant configuration, treat this as higher priority. Beyond patching, evaluate whether your permission model explicitly enumerates filesystem capabilities or treats them as implied operations. The latter is the reproducible failure mode.

Reviewed through automated stages and approved by a human before publication.