{"vulnerability": "CVE-2026-72850", "sightings": [{"uuid": "0ef642ba-c3ce-42be-820a-750b02cf2620", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-72850", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117091980194395947", "content": "CVE-2026-72850: CRITICAL path traversal (CVSS 9.4) in Budibase server <3.40.0 lets authenticated builders write files outside temp dirs. Cloud-hosted \u2014 vendor patch applied server-side. Confirm upgrade. Details: https://radar.offseq.com/threat/cve-2026-72850-improper-limitation-of-a-pathname-to-a-restricted-directory-path-traversal-in-budibase-119aa29b1a7d2c6b #OffSeq #Budibase #Infosec #Vuln", "creation_timestamp": "2026-08-14T04:30:27.429193Z"}, {"uuid": "3736be61-a965-4342-ad06-220553da4e18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-72850", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mszd5v5xjb2f", "content": "Budibase server <3.40.0 has a critical path traversal bug (CVSS 9.4): authenticated builders can write files anywhere writable by the process. Ensure your cloud-hosted instance is patched per vendor. https://radar.offseq.com/threat/cve-2026-72850-improper-limitation-of-a-pathname-to-a-restricted-...", "creation_timestamp": "2026-08-14T04:30:30.403044Z"}, {"uuid": "f47d123f-8afa-49cc-9065-de6760e6f967", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72850", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mszg7v3tdq2j", "content": "Daily IT Security Digest \u2014 2026-08-14\n# Daily IT Security Digest \u2014 2026-08-14\n\n## Top Cybersecurity News Today\n\n### 1. Budibase Server Hit by Dual Critical Vulnerabilities (CVE-2026-72850, CVE-2026-72851)\nTwo critical flaws in Budibase server versions below 3.40.0 demand immediate attention.", "creation_timestamp": "2026-08-14T05:25:17.290537Z"}, {"uuid": "cd71cf60-30a0-48e4-85c1-3d5c2c043a50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72850", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt4sdkcnwo2c", "content": "CVE-2026-72850\nBudibase, a low-code development platform, has a security flaw that allows attackers with a user account to upload files and write them to any location on the server. This is a concern because it could allow\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-15T13:40:04.754483Z"}, {"uuid": "61b27f5d-7bb7-4c06-8134-8985959e3aca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72850", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msyqp3ayiz2m", "content": "CVE-2026-72850 - server\nAn attacker with access to Budibase can upload files that trick the system into writing to any file on the server. This can lead to sensitive data being compromised or system\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#server #budibase #CVE #infosec", "creation_timestamp": "2026-08-13T23:00:05.296249Z"}, {"uuid": "ff2e85cd-cb82-428f-8a77-e8e2d2866147", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72850", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msz66wwti42b", "content": "\ud83d\udd34 CVE-2026-72850 - Critical (9.1)\n\nBudibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-72850/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-14T03:01:36.605026Z"}]}