Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck

CVE-2026-100680Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import

High 8.1

In plain English

A high-severity information exposure in server from budibase. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.3%top 77.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to read arbitrary local files. Attackers with builder access can embed file:// references in OpenAPI specifications submitted to the import endpoint to exfiltrate sensitive files including environment variables containing JWT secrets, API keys, and database credentials.

Affected products (as reported)

Vendor	Product	Versions
budibase	server	0 – before 3.45.0

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

GitHub Security Advisory (GHSA-8xr5-pggf-26jq) vendor-advisory
VulnCheck Advisory: Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import third-party-advisory