Quick answers
- Is CVE-2026-100682 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-100682 being exploited in the wild.
- How severe is CVE-2026-100682?
- High severity, with a CVSS score of 8.8, published 26 September 2026.
- Which products and versions are affected?
- Budibase Server before 3.45.0.
- Is there a fix for CVE-2026-100682?
- A patch was published on 2026-09-10: Patch released in version 3.45.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-100682 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-100682?
- Check whether you run Budibase Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The PWA icon upload endpoint in Budibase uses extract-zip@2.0.1, which validates only the directory component of ZIP entries but not the leaf filename, failing to detect symlinks. An attacker can place a symlink at the leaf entry pointing to an arbitrary absolute path, followed by a duplicate regular file entry of the same name, causing the extractor to write through the symlink. The vulnerability requires BUILDER role authorization and affects versions before 3.45.0.
Affected products
- Budibase Server before 3.45.0
Timeline
- 2026-09-26: disclosed: Public disclosure via NVD and GitHub Security Advisory
- 2026-09-10: patched: Patch released in version 3.45.0