CVE-2026-54352 - Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload
CVE ID :CVE-2026-54352 Published : June 26, 2026, 8:32 p.m. | 4 hours, 38 minutes ago Description :Budibase is an open-source low-code platform. Prior to 3.39.9, `POST /api/pwa/process-zip` at packages/server/src/api/routes/static.ts:24 accepts a builder-uploaded .zip, extracts it with...