Budibase Server versions prior to 3.45.0 allow an attacker with the BUILDER role to upload a specially crafted ZIP file to the PWA icon endpoint. The server extracts the archive without validating symlink entries, enabling the attacker to overwrite arbitrary files with root privileges. The ability to write files as root exposes the system to remote code execution, granting full control over the affected host.

The vulnerability exists in Budibase Server before version 3.45.0. Any installation of Budibase Server with a BUILDER role is directly affected; older releases from the start are included in the impact scope.

The CVSS score of 8.7 indicates a high severity, and while EPSS data is not available, the potential for remote code execution keeps the risk elevated. The exploit requires only a BUILDER role, implying the attacker must have internal or privileged access. The vulnerability is not listed in CISA’s KEV catalog, but its impact warrants high vigilance.