Skip to content
OpenAdvisories
High WID-SEC-2026-0990 7 CVEs

Budibase: Mehrere Schwachstellen

Published Apr 7, 2026 · Updated Apr 7, 2026 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in Budibase ausnutzen, um beliebigen Code auszuführen – sogar mit Root-Rechten –, sich erweiterte Rechte zu verschaffen – sogar Administratorrechte –, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, einen Denial-of-Service-Zustand herbeizuführen oder vertrauliche Informationen offenzulegen.

Product

Budibase ist eine quelloffene Low-Code-Plattform für die Erstellung interner Anwendungen, wie z. B. Verwaltungspanels.

Vulnerabilities 7

  • Critical 9.6
    CVE-2026-31818

    Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist

    Budibase is an open-source low-code platform. Prior to version 3.33.4, a server-side request forgery (SSRF) vulnerability exists in Budibase's REST datasource connector. The platform's SSRF protection mechanism (IP blacklist) is rendered completely ineffectiv…

    Budibase budibase @budibase/backend-core npm
  • Critical 9.1
    CVE-2026-35216 EPSS 11%

    Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step

    Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authent…

    Budibase budibase @budibase/server npm
  • High 8.7
    CVE-2026-25044

    Budibase: Command Injection in Bash Automation Step

    Budibase is an open-source low-code platform. Prior to version 3.33.4, the bash automation step executes user-provided commands using execSync without proper sanitization or validation. User input is processed through processStringSync which allows template i…

    Budibase budibase @budibase/server npm
  • High 8.7
    CVE-2026-35214

    Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write

    Budibase is an open-source low-code platform. Prior to version 3.33.4, the plugin file upload endpoint (POST /api/plugin/upload) passes the user-supplied filename directly to createTempFolder() without sanitizing path traversal sequences. An attacker with Glo…

    Budibase budibase @budibase/server npm
  • High 8.7
    CVE-2026-35218

    Budibase: Stored XSS via unsanitized entity names rendered with {@html} in Builder Command Palette

    Budibase is an open-source low-code platform. Prior to version 3.32.5, Budibase's Builder Command Palette renders entity names (tables, views, queries, automations) using Svelte's {@html} directive without any sanitization. An authenticated user with Builder …

    Budibase budibase
  • Medium 5.7
    CVE-2026-25040

    Budibase Vulnerable to Privilege Escalation via API Abuse – Creator Can Invite Users with Admin/Any Role

    Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions up to and including 3.26.3, a Creator-level user, who normally has no UI permission to invite users, can manipulate API requests to invite new users with any…

    Budibase budibase
  • Medium 5.3
    CVE-2026-25043

    Budibase: Unauthenticated Password Reset Endpoint Lacks Rate Limiting, Enabling Email Flooding

    Budibase is an open-source low-code platform. Prior to version 3.23.25, a business logic vulnerability exists in Budibase’s password reset functionality due to the absence of rate limiting, CAPTCHA, or abuse prevention mechanisms on the “Forgot Password” endp…

    Budibase budibase

Revision history

  1. #1

    Initiale Fassung

References