Threat Intelligence Database

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRITE check, which BASIC users hold by default. Attackers can specify arbitrary S3 buckets in the request body to generate presigned URLs for writing to any bucket accessible by the stored IAM credentials, enabling unauthorized file uploads.

Budibase server versions prior to 3.40.0 contain a server-side request forgery (SSRF) vulnerability that affects OpenAPI query import and REST query execution. Authenticated builder-level users can exploit this flaw to bypass DNS pinning protections via DNS rebinding attacks. This allows attackers to configure hostnames that initially resolve to public IP addresses during validation but later resolve to loopback or private IP addresses during actual connection, enabling access to internal HTTP services that should be blocked.

Budibase server versions prior to 3.40.0 contain an unauthenticated SQL injection vulnerability in webhook-triggered automations that use EXECUTE_QUERY steps. This allows attackers to send crafted JSON payloads to webhook endpoints, injecting SQL commands that execute with database credentials configured by the builder. The vulnerability can lead to unauthorized data exfiltration, modification, and persistence in connected datasources such as Snowflake. The vulnerability has a critical severity rating with a CVSS score of 9. A patch is available, and since this is a cloud service, the vendor manages remediation server-side.

CVE-2026-72850 is a critical path traversal vulnerability in Budibase server versions before 3.40.0. It allows authenticated users with builder privileges to upload files with crafted filenames containing traversal sequences (e.g., '..') that are not properly sanitized. These sequences are preserved during workspace export, enabling attackers to write arbitrary content to any path writable by the Budibase process. The vulnerability has a high CVSS 4.0 score of 9.4, indicating severe impact. Budibase is a cloud service, and a patch is available for this issue.

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind their chat identity to a victim user's account, enabling impersonation within agent operations and inheritance of victim permissions.

Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON structural characters to alter MongoDB queries, bypassing filters to read, modify, or delete arbitrary documents.

Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass per-user access controls, read arbitrary documents, execute JavaScript via $where operators, or modify collections through update and delete operations.

Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to internal IP addresses, bypassing blacklist protection to access cloud metadata endpoints and internal services.

Budibase, an open-source low-code platform for building internal applications, has multiple vulnerabilities that allow manipulation of files. These issues affect versions up to and including 3.39.0. No CVSS score is provided, and no known exploits are reported in the wild. The vulnerabilities were published by the Bundesamt für Sicherheit in der Informationstechnik. No patch or remediation information is currently available.

A vulnerability identified as CVE-2026-45717 affects Budibase, an open-source low-code platform used for creating internal applications such as admin panels. The issue allows an attacker to bypass security controls. The affected versions include Budibase versions prior to 3.38.1. There is no CVSS score available, no known exploits in the wild, and no patch or remediation information provided by the vendor. The vulnerability was published by the Bundesamt für Sicherheit in der Informationstechnik. Due to the lack of detailed technical information and absence of a vendor advisory specifying a fix, the patch status is not confirmed.