# CVE-2026-46426: Budibase unrestricted file upload leading to stored XSS

Source: https://junglewise.ai/threats/cve-2026-46426-budibase-unrestricted-file-upload-leading-to-stored-xss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-46426 · Severity: high · CVSS 7.6 · Published 2026-05-27

Budibase is an open-source low-code platform used by businesses to build internal applications and workflows. A security flaw in the platform's file upload system allows users with basic access to upload malicious files, such as web pages or images containing hidden scripts. If another user or administrator views these files, the scripts can execute in their browser, potentially leading to the theft of login sessions, unauthorized data access, or full account takeover.

Technologies: [budibase (npm)](https://junglewise.ai/threats/technologies/budibase). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-46426 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46426 being exploited in the wild.

**How severe is CVE-2026-46426?** High severity, with a CVSS score of 7.6, published 27 May 2026.

**Which products and versions are affected?** budibase (npm) < 3.38.2, SEMVER:introduced=0,fixed=3.38.2.

**Is there a fix for CVE-2026-46426?** Yes. budibase (npm): upgrade to 3.38.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46426 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-46426?** Check whether you run budibase (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- budibase (npm): upgrade to 3.38.2 or later

  ```sh
  npm install budibase@3.38.2
  ```


## Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in Budibase due to unrestricted file uploads in the POST /api/attachments/process and POST /api/attachments/:tableId/upload endpoints. The application conditionally bypasses dangerous file extension checks (e.g., .html, .svg, .js) for authenticated users in self-hosted deployments. An attacker with 'Builder' or 'Power' roles can upload files containing malicious JavaScript, which are stored in the object store (MinIO/S3) with their original MIME types. When a victim accesses the resulting signed URL, the payload executes in their browser context. This can lead to session cookie theft and workspace takeover. The issue is fixed in version 3.38.2 by enforcing active-content restrictions regardless of user role or hosting environment.

## Affected products

- Budibase Budibase < 3.38.2

## Identifiers

- CVE-2026-46426
- GHSA-82rc-gxrg-v4gf

## Timeline

- 2026-05-13: patched: Version 3.38.2 released
- 2026-05-14: advisory: GitHub Security Advisory published
- 2026-05-27: disclosed: CVE published to NVD

## References

- [https://github.com/Budibase/budibase/releases/tag/3.38.2](https://github.com/Budibase/budibase/releases/tag/3.38.2)
- [https://github.com/Budibase/budibase/security/advisories/GHSA-82rc-gxrg-v4gf](https://github.com/Budibase/budibase/security/advisories/GHSA-82rc-gxrg-v4gf)

## Related threats

- [Budibase database connector SQL injection in PostgreSQL, MS SQL, and MySQL](https://junglewise.ai/threats/cve-2026-64657-budibase-database-connector-sql-injection-in-postgresql-ms-sql)
- [Budibase SSRF in executeQuery automation step](https://junglewise.ai/threats/cve-2026-48128-budibase-ssrf-in-executequery-automation-step)
- [Budibase authorization bypass in row action trigger](https://junglewise.ai/threats/cve-2026-45718-budibase-authorization-bypass-in-row-action-trigger)
- [Budibase SSRF via URL validation bypass in Plugin upload](https://junglewise.ai/threats/cve-2026-45061-budibase-ssrf-via-url-validation-bypass-in-plugin-upload)
- [Budibase unrestricted SSRF in REST datasource query preview](https://junglewise.ai/threats/cve-2026-33226-budibase-unrestricted-ssrf-in-rest-datasource-query-preview)