Executive brief
Budibase, a platform for building internal business applications, contains multiple security flaws in how it connects to external databases like PostgreSQL, MySQL, and Microsoft SQL Server. An attacker with administrative access could use these flaws to execute unauthorized commands on the connected database, potentially leading to the theft of sensitive data or a complete takeover of the database server. In some configurations, this could even allow the attacker to execute commands on the underlying operating system.
Technical details
Budibase is vulnerable to three distinct SQL injection flaws within its database connectors for PostgreSQL, Microsoft SQL Server, and MySQL. The root cause is the direct interpolation of user-controlled schema and table configuration fields into raw SQL queries without proper escaping or parameterization during database introspection. In PostgreSQL, the 'schema' field lacks double-quote escaping in 'SET search_path' queries; in MS SQL, single-quote delimiters are not escaped during schema introspection; and in MySQL, backticks are not escaped in 'DESCRIBE' queries while 'multipleStatements' is enabled. An authenticated administrator can exploit these to execute arbitrary DDL/DML commands, access sensitive system tables like 'pg_shadow', or achieve OS command execution via 'xp_cmdshell' in MS SQL environments. These issues are resolved in version 3.39.19.
Affected products
- Budibase budibase < 3.39.19
Timeline
- 2026-06-18: advisory
- 2026-06-18: disclosed
- 3.39.19: patched