CVE-2026-35214

Budibase (open-source low-code platform) prior to version 3.33.4 is affected by a path-traversal issue in the plugin file upload endpoint (POST /api/plugin/upload). The vulnerability arises because the user-supplied filename is passed directly to createTempFolder() without sanitizing path travers...