Budibase, an open‑source low‑code platform, allows a builder to upload a .zip file via POST /api/pwa/process‑zip. The server extracts the archive with extract‑zip and then, for each icon specified, resolves the icon’s path relative to a temporary directory and streams the file’s bytes to a MinIO bucket. Because extract‑zip preserves absolute symlink targets and the icon source validator does not reject symlink entries, an attacker who can upload a crafted zip containing a symlink to any server‑accessible file can read that file’s contents and retrieve it through a subsequent GET request. This vulnerability injects arbitrary server files into the asset pipeline, exposing sensitive data. The weakness is a classic path traversal and symbolic‑link exploitation, mapped to CWE‑22 and CWE‑59.

Budibase instances running version 3.39.8 or earlier are susceptible. The issue is resolved in Budibase 3.39.9; any version prior to that release must be considered vulnerable.

The CVSS score of 9.6 indicates high severity; there is no EPSS data available, and the vulnerability is not listed in CISA KEV. Attackers can trigger the flaw by sending a specially crafted zip file to the exposed endpoint, which is reachable over the network. Successful exploitation requires the attacker to have the ability to upload zip files, typically through a workspace builder role. Once the zip is processed the attacker can read any file the Budibase process can access, resulting in full information disclosure of server files.