Executive brief
Budibase is an open-source low-code platform used by businesses to build internal applications and workflows. A security flaw in the platform's file upload system allows users with basic access to upload malicious files, such as web pages or images containing hidden scripts. If another user or administrator views these files, the scripts can execute in their browser, potentially leading to the theft of login sessions, unauthorized data access, or full account takeover.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in Budibase due to unrestricted file uploads in the POST /api/attachments/process and POST /api/attachments/:tableId/upload endpoints. The application conditionally bypasses dangerous file extension checks (e.g., .html, .svg, .js) for authenticated users in self-hosted deployments. An attacker with 'Builder' or 'Power' roles can upload files containing malicious JavaScript, which are stored in the object store (MinIO/S3) with their original MIME types. When a victim accesses the resulting signed URL, the payload executes in their browser context. This can lead to session cookie theft and workspace takeover. The issue is fixed in version 3.38.2 by enforcing active-content restrictions regardless of user role or hosting environment.
Affected products
- Budibase Budibase < 3.38.2
Timeline
- 2026-05-13: patched: Version 3.38.2 released
- 2026-05-14: advisory: GitHub Security Advisory published
- 2026-05-27: disclosed: CVE published to NVD