Skip to content
OpenAdvisories
Critical WID-SEC-2026-0651 5 CVEs

Budibase: Mehrere Schwachstellen

Published Mar 9, 2026 · Updated Mar 9, 2026 · de-DE

Platform: Linux

Summary

Ein Angreifer kann eine Schwachstelle in Budibase ausnutzen, um Dateien zu manipulieren, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen Cross-Site Scripting Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.

Product

Budibase ist eine quelloffene Low-Code-Plattform für die Erstellung interner Anwendungen, wie z. B. Verwaltungspanels.

Vulnerabilities 5

  • Critical 9.6
    CVE-2026-30240

    Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets

    Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.5 and earlier, a path traversal vulnerability in the PWA (Progressive Web App) ZIP processing endpoint (POST /api/pwa/process-zip) allows an authenticated user w…

    Budibase budibase
  • Critical 9.1
    CVE-2026-31816 Public exploit Scanner template EPSS 17%

    Budibase Universal Auth Bypass via Webhook Query Param Injection

    Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.4 and earlier, the Budibase server's authorized() middleware that protects every server-side API endpoint can be completely bypassed by appending a webhook path …

    Budibase budibase
  • High 8.9
    CVE-2026-25737

    Budibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS)

    Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.24.0 and earlier, an arbitrary file upload vulnerability exists even though file extension restrictions are configured. The restriction is enforced only at the UI l…

    Budibase budibase
  • High 8.7
    CVE-2026-25045

    Budibase Critical Privilege Escalation & IDOR via Missing RBAC on User Role Management (Creator-Role)

    Budibase is a low code platform for creating internal tools, workflows, and admin panels. This issue is a combination of Vertical Privilege Escalation and IDOR (Insecure Direct Object Reference) due to missing server-side RBAC checks in the /api/global/users …

    Budibase budibase
  • High 8.6
    CVE-2026-25041

    Budibase has a Command Injection in PostgreSQL Dump Command

    Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.23.22 and earlier, the PostgreSQL integration constructs shell commands using user-controlled configuration values (database name, host, password, etc.) without pro…

    Budibase budibase @budibase/server npm

Revision history

  1. #1

    Initiale Fassung

References