Vulnerability · Published Mar 9, 2026 · Assigned by GitHub_M
CVE-2026-25737Budibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS)
High 8.9
In plain English
A high-severity security flaw in budibase from Budibase. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Severity (CVSS 3.1)8.9High
Exploit odds (30 days)0.3%top 76.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.24.0 and earlier, an arbitrary file upload vulnerability exists even though file extension restrictions are configured. The restriction is enforced only at the UI level. An attacker can bypass these restrictions and upload malicious files.
Affected products (as reported)
Weakness: CWE-602 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
References
- https://github.com/Budibase/budibase/security/advisories/GHSA-2hfr-343j-863r x_refsource_CONFIRM