CVE-2026-54352

Budibase is an open-source low-code platform. Prior to 3.39.9, "POST /api/pwa/process-zip" at packages/server/src/api/routes/static.ts:24 accepts a builder-uploaded .zip, extracts it with [email protected] into a temp directory, then for each entry listed in icons.json validates the icon path,...