{"id":"CVE-2026-100680","published":"2026-09-26T14:16:52.150","lastModified":"2026-09-28T17:17:44.953","description":"Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to read arbitrary local files. Attackers with builder access can embed file:// references in OpenAPI specifications submitted to the import endpoint to exfiltrate sensitive files including environment variables containing JWT secrets, API keys, and database credentials.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-200"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-8xr5-pggf-26jq","tags":[]},{"url":"https://www.vulncheck.com/advisories/budibase-before-3.45.0-arbitrary-local-file-read-via-openapi-import","tags":[]},{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-8xr5-pggf-26jq","tags":[]}],"exploitRefs":[{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-8xr5-pggf-26jq","tags":[]},{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-8xr5-pggf-26jq","tags":[]}],"hasPoc":true,"ai":null}