Is CVE-2026-46426 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46426 being exploited in the wild.

How severe is CVE-2026-46426?

High severity, with a CVSS score of 7.6, published 27 May 2026.

Which products and versions are affected?

budibase (npm) < 3.38.2, SEMVER:introduced=0,fixed=3.38.2.

Is there a fix for CVE-2026-46426?

Yes. budibase (npm): upgrade to 3.38.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46426 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-46426?

Check whether you run budibase (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46426: Budibase unrestricted file upload leading to stored XSS

Q: Which products and versions are affected?

budibase (npm) < 3.38.2, SEMVER:introduced=0,fixed=3.38.2.

Q: Is there a fix for CVE-2026-46426?

Yes. budibase (npm): upgrade to 3.38.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-46426 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-46426?

Check whether you run budibase (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46426 · Severity: high · CVSS 7.6 · Published 2026-05-27

Budibase is an open-source low-code platform used by businesses to build internal applications and workflows. A security flaw in the platform's file upload system allows users with basic access to upload malicious files, such as web pages or images containing hidden scripts. If another user or administrator views these files, the scripts can execute in their browser, potentially leading to the theft of login sessions, unauthorized data access, or full account takeover.

Technologies: budibase (npm). Vendors: npm.

Quick answers

Is CVE-2026-46426 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46426 being exploited in the wild.
How severe is CVE-2026-46426?: High severity, with a CVSS score of 7.6, published 27 May 2026.
Which products and versions are affected?: budibase (npm) < 3.38.2, SEMVER:introduced=0,fixed=3.38.2.
Is there a fix for CVE-2026-46426?: Yes. budibase (npm): upgrade to 3.38.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46426 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-46426?: Check whether you run budibase (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

budibase (npm): upgrade to 3.38.2 or later
```
npm install budibase@3.38.2
```

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in Budibase due to unrestricted file uploads in the POST /api/attachments/process and POST /api/attachments/:tableId/upload endpoints. The application conditionally bypasses dangerous file extension checks (e.g., .html, .svg, .js) for authenticated users in self-hosted deployments. An attacker with 'Builder' or 'Power' roles can upload files containing malicious JavaScript, which are stored in the object store (MinIO/S3) with their original MIME types. When a victim accesses the resulting signed URL, the payload executes in their browser context. This can lead to session cookie theft and workspace takeover. The issue is fixed in version 3.38.2 by enforcing active-content restrictions regardless of user role or hosting environment.

Affected products

Budibase Budibase < 3.38.2

Identifiers

CVE-2026-46426
GHSA-82rc-gxrg-v4gf

Timeline

2026-05-13: patched: Version 3.38.2 released
2026-05-14: advisory: GitHub Security Advisory published
2026-05-27: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.