CVE-2026-100680

8.1 HIGHpublic exploit available

Published 2026-09-26 · Updated 2026-09-28

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to read arbitrary local files. Attackers with builder access can embed file:// references in OpenAPI specifications submitted to the import endpoint to exfiltrate sensitive files including environment variables containing JWT secrets, API keys, and database credentials.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-200

Public exploit & PoC references

https://github.com/Budibase/budibase/security/advisories/GHSA-8xr5-pggf-26jq
https://github.com/Budibase/budibase/security/advisories/GHSA-8xr5-pggf-26jq

All references

https://github.com/Budibase/budibase/security/advisories/GHSA-8xr5-pggf-26jq
https://www.vulncheck.com/advisories/budibase-before-3.45.0-arbitrary-local-file-read-via-openapi-import
https://github.com/Budibase/budibase/security/advisories/GHSA-8xr5-pggf-26jq

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

UNSCOREDCVE-2026-100241
UNSCOREDCVE-2026-100244
MEDIUMCVE-2026-100286
UNSCOREDCVE-2026-100377
UNSCOREDCVE-2026-100379PoC
MEDIUMCVE-2026-100418PoC
MEDIUMCVE-2026-100528PoC
HIGHCVE-2026-100543PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.