GHSA-2wfh-rcwf-wh23: Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write

Budibase has a path traversal vulnerability in its plugin upload endpoint where user-supplied filenames are not sanitized before being passed to filesystem operations. An attacker with Global Builder privileges can craft an upload with filenames containing `../` sequences to delete arbitrary directories or write files anywhere on the system that the Node.js process can access, potentially causing data loss or denial of service (making the application unavailable).