WID-SEC-2026-4504 — Budibase: Mehrere Schwachstellen

Summary

Ein Angreifer kann mehrere Schwachstellen in Budibase ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder zu löschen, Cross-Site-Scripting- und SQL-Injection-Angriffe durchzuführen, Berechtigungen zu erweitern, Administratorrechte zu erlangen, beliebigen Code mit Anwendungs-, Dienst- oder Root-Rechten auszuführen oder einen Denial-of-Service-Zustand zu verursachen.

Product

Budibase ist eine quelloffene Low-Code-Plattform für die Erstellung interner Anwendungen, wie z. B. Verwaltungspanels.

Vulnerabilities 1

Critical 9.1

CVE-2026-82244

Budibase before 3.41.3 Remote Code Execution via Plugin eval()

Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval() on plugin JavaScript files withou…

Budibase server

Aug 28, 2026

Revision history

2026-11-10 #1
Initiale Fassung

References

GitHub Security Advisory GHSA-23m9-j429-7v25 vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-23m9-j429-7v25
GitHub Security Advisory GHSA-25qc-m4pw-2w8r vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-25qc-m4pw-2w8r
GitHub Security Advisory GHSA-28cm-wmmh-5qg6 vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-28cm-wmmh-5qg6
GitHub Security Advisory GHSA-3rh4-6228-7267 vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-3rh4-6228-7267
GitHub Security Advisory GHSA-4hc3-m622-f9fr vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-4hc3-m622-f9fr
GitHub Security Advisory GHSA-57rq-987c-h82v vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-57rq-987c-h82v
GitHub Security Advisory GHSA-5rq2-4mjm-m7q2 vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-5rq2-4mjm-m7q2
GitHub Security Advisory GHSA-622v-wwmm-7xrf vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-622v-wwmm-7xrf
GitHub Security Advisory GHSA-6wc7-w493-mw5m vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-6wc7-w493-mw5m
GitHub Security Advisory GHSA-7h79-cmq7-455p vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-7h79-cmq7-455p
GitHub Security Advisory GHSA-86p2-6qfw-c64v vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-86p2-6qfw-c64v
GitHub Security Advisory GHSA-c24r-7gmq-4rgm vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-c24r-7gmq-4rgm
GitHub Security Advisory GHSA-c52c-wqg7-jr92 vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-c52c-wqg7-jr92
GitHub Security Advisory GHSA-f337-5wfg-hxhr vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-f337-5wfg-hxhr
GitHub Security Advisory GHSA-gvxv-2hpp-8fwv vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-gvxv-2hpp-8fwv
GitHub Security Advisory GHSA-j9fw-7p3m-48p9 vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-j9fw-7p3m-48p9
GitHub Security Advisory GHSA-jm6f-xhr9-26ff vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-jm6f-xhr9-26ff
GitHub Security Advisory GHSA-jm85-crv2-88px vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-jm85-crv2-88px
GitHub Security Advisory GHSA-jrg5-3q3g-h7rx vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-jrg5-3q3g-h7rx
GitHub Security Advisory GHSA-m2pm-g733-7vqw vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-m2pm-g733-7vqw
GitHub Security Advisory GHSA-mvg6-4xvw-gpvc vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-mvg6-4xvw-gpvc
GitHub Security Advisory GHSA-p25h-79jv-pph3 vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-p25h-79jv-pph3
GitHub Security Advisory GHSA-p5gp-4j5q-985c vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-p5gp-4j5q-985c
GitHub Security Advisory GHSA-p7c8-m379-jf3x vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-p7c8-m379-jf3x
GitHub Security Advisory GHSA-q4f7-c337-92c9 vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-q4f7-c337-92c9
GitHub Security Advisory GHSA-r2q3-7m4h-63qg vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-r2q3-7m4h-63qg
GitHub Security Advisory GHSA-w7m4-jhq6-jmrg vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-w7m4-jhq6-jmrg
GitHub Security Advisory GHSA-wr7j-r9v4-6rjh vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-wr7j-r9v4-6rjh
GitHub Security Advisory GHSA-x4w8-596q-fmh7 vom 2026-11-10
https://github.com/Budibase/budibase/security/advisories/GHSA-x4w8-596q-fmh7