In Budibase versions 3.31.5 and earlier, an authenticated user with builder privileges can upload a specially crafted ZIP file to the PWA processing endpoint. The server unsafely evaluates file paths extracted from the ZIP, allowing the attacker to read any file on the filesystem, including sensitive environment variables such as JWT secrets and database credentials. The extracted file contents are then stored in an object store where they can be retrieved through signed URLs, resulting in the exfiltration of cryptographic secrets and service tokens in a single request. The vulnerability constitutes a high‑severity file‑reading flaw that can fully compromise the platform.

The affected product is Budibase, the low‑code platform for internal tools, workflows, and admin panels. All installations running version 3.31.5 and earlier are vulnerable. No further version details are provided in the advisory.

The CVSS score of 9.6 indicates a critical impact. The EPSS score is less than 1 %, suggesting a low probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. The attack requires the attacker to have authenticated builder privileges and to upload a ZIP file to the /api/pwa/process-zip endpoint. Once exploited, the attacker can read arbitrary files and exfiltrate secrets, effectively compromising the entire Budibase deployment.