Summary
Budibase Server before the relevant security fix may allow an authenticated user with the BUILDER role to write arbitrary files through the PWA icon upload endpoint. A crafted ZIP archive containing symlinks and duplicate entries can bypass extraction safeguards, potentially enabling code execution with root privileges.
Affected context
The vulnerability occurs in Budibase Server deployments where the PWA icon upload endpoint accepts ZIP archives and extracts their contents without fully validating symlink targets and duplicate archive entries. Exploitation generally depends on an attacker having a BUILDER-level account and access to the affected upload workflow.
Exploit preconditions
- Attack surface: PWA icon upload endpoint
- Required access: An authenticated account with the BUILDER role
- Trigger point: Server-side extraction of a user-supplied ZIP archive
- Relevant condition: Archive handling permits symlink entries or duplicate
file entries to influence extraction destinations
- Why exploitation is possible: File paths and filesystem links are not
sufficiently constrained before files are written, allowing writes outside
the intended upload directory
Why this happens
The underlying bug is an unsafe archive extraction pattern in which user-controlled ZIP metadata is trusted before filesystem effects are sufficiently constrained. In particular, inadequate symlink validation and duplicate-entry handling can cause extracted content to resolve to unintended filesystem locations. This behavior maps to CWE-22, Improper Limitation of a Pathname to a Restricted Directory, because archive entries can escape the intended extraction boundary.
Potential impact
- An attacker may overwrite application or system files
- The server process could be manipulated to execute attacker-controlled code
- Sensitive data may be modified, destroyed, or exposed
- The Budibase instance could be fully compromised
- Other services or workloads may be affected if the process has excessive privileges
General mitigation guidance
Defensive mitigation typically focuses on treating uploaded archives as
untrusted input and enforcing a strict extraction boundary.
Common patterns include:
- Rejecting symlink, hard-link, device, and other special archive entries
- Canonicalizing destination paths before writing and verifying that they remain
within a dedicated extraction directory
- Handling duplicate filenames deterministically or rejecting them
- Extracting into isolated, temporary locations with restrictive permissions
- Running the application with a non-root, least-privilege service account
- Limiting upload size, archive complexity, and writable filesystem locations
- Separating uploaded assets from executable application directories
- Applying authorization checks and reducing the number of roles permitted to
use sensitive upload functionality
How teams detect issues like this
Detection programs can review archive extraction code for direct writes based
on untrusted entry names, missing canonical-path checks, and incomplete
handling of symlink or hard-link entries. Code review should treat archive
upload endpoints, filesystem extraction helpers, and path-joining operations
as security-sensitive.
Runtime monitoring can alert on unexpected writes outside designated upload
directories, changes to application files, creation of links by the service
account, and new executable content in writable paths. Static analysis,
dependency-aware scanning, and automated security review tools may help
identify unsafe extraction patterns before deployment.
