Budibase server versions before 3.45.0 allow authenticated builders to read arbitrary local files by enabling external JSON reference resolution in the OpenAPI/Swagger import validator. By embedding file:// references into imported OpenAPI specifications, an attacker can exfiltrate sensitive data such as environment variables that contain JWT secrets, API keys, and database credentials. The flaw enables confidential data disclosure rather than code execution or denial of service, leading to potential compromise of the entire deployment if secrets are accessed.

Budibase server versions prior to 3.45.0 are affected. The vulnerability applies to the server component that processes OpenAPI imports for users with builder privileges.

The CVSS score of 8.6 indicates a high severity vulnerability. Exploitation requires authenticated access with builder role; the attacker must submit an OpenAPI spec to the import endpoint. EPSS is not available, and the vulnerability is not listed in CISA KEV, but the high CVSS and direct data exfiltration capability make it a significant risk for environments where builder accounts have elevated privileges.