Budibase versions up to 3.34.11 have a Server-Side Request Forgery (SSRF) vulnerability in the Plugin URL upload endpoint due to insufficient URL validation. The endpoint only checks if the URL contains the substring '.tar.gz' anywhere, allowing attackers to bypass this check and cause the server to fetch arbitrary URLs, including internal services. This vulnerability can be chained with a blacklist bypass or exploited via HTTP redirects to access sensitive internal resources. The vulnerability requires low privileges (Global Builder role) and no user interaction. A fix is available in Budibase version 3.35.10.