A path traversal flaw in Budibase's plugin upload endpoint allows an attacker with Global Builder privileges to supply a filename containing '../', causing the server to create temporary folders outside the intended directory. The flaw enables deletion of arbitrary directories using rmSync and writing of arbitrary files via tarball extraction, which can compromise the integrity and confidentiality of the application and underlying filesystem.

Budibase low‑code platform versions prior to 3.33.4 are affected. The issue resides in the plugin file upload API (/api/plugin/upload). The vulnerability is present in all distributions that expose this endpoint and rely on Node.js to process uploads.

The CVSS score of 8.7 indicates a high severity vulnerability. Because the vulnerability requires only authenticated Global Builder privileges and no special network exposure, exploitability is practical for users with those rights. EPSS data is unavailable, but the lack of an official KEV listing does not diminish its risk. An attacker can craft a multipart upload with a malicious filename to delete or overwrite files, potentially escalating to full server compromise if additional privileges are present.