CVE-2026-46426
High · 7.6CVSS
7.6
EPSS
0.3%
Published
May 27, 2026
CISA due date
—
The record
Budibase is an open-source low-code platform. Prior to 3.38.2, the file upload endpoint POST /api/attachments/process does not enforce active-content restrictions for authenticated users. The checks for dangerous file extensions are conditionally wrapped inside if (isPublicUser) or if (isPublicUser || !env.SELF_HOSTED), meaning any authenticated builder can upload executable web content — SVG files with inline <script> tags, HTML pages with JavaScript, .js modules — which are then stored in the object store (MinIO/S3) with their correct MIME types. When the resulting signed URL is opened by any app user, the browser executes the payload. Impact is persistent stored XSS over all application end users. This vulnerability is fixed in 3.38.2.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | budibase | 0 | 3.38.2 |
Related vulnerabilities
- GHSA-82rc-gxrg-v4gf Budibase: Unrestricted Upload of File with Dangerous Type Same vulnerability
- GHSA-qqf5-x7mj-v43p budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL Also affects budibase
- GHSA-6964-pp88-6wp9 Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step Also affects budibase
- CVE-2026-48128 Budibase is an open-source low-code platform. Also affects budibase
- CVE-2026-45718 Budibase is an open-source low-code platform. Also affects budibase
- CVE-2026-45061 Budibase is an open-source low-code platform. Also affects budibase
- GHSA-3263-v5v9-xq8q Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action… Also affects budibase
- GHSA-xh5j-727m-w6gg Budibase vulnerable to SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload… Also affects budibase