An attacker who has Global Builder authority can submit a multipart upload to the plugin upload endpoint, including a filename that contains path‑traversal characters. The application forwards this filename directly to the temporary folder creation routine without sanitizing it, allowing the attacker to delete any directory the Node.js process can access and to extract tarball contents to arbitrary filesystem locations, effectively creating, overwriting, or removing files on the server.

Budibase, the open‑source low‑code platform released before version 3.33.4, contains the vulnerable plugin upload endpoint.

The vulnerability has a high severity score and, while the likelihood of exploitation is currently low, it is exploitable by authenticated users with Global Builder privileges. An attacker could send a crafted upload request to the vulnerable endpoint, which would then perform privileged filesystem operations such as directory deletion or arbitrary file write on the server.