CVE-2026-25737: Budibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS)
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.24.0 and earlier, an arbitrary file upload vulnerability exists even though file extension restrictions are configured. The restriction is enforced only at the UI level. An attacker can bypass these restrictions and upload malicious files.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25737?
CVE-2026-25737 is considered critical due to its potential to facilitate arbitrary file uploads leading to server-side request forgery (SSRF) and stored cross-site scripting (XSS).
How do I fix CVE-2026-25737?
To fix CVE-2026-25737, you should upgrade Budibase to version 3.25.0 or later, which addresses this vulnerability by implementing stricter file upload validation.
What versions of Budibase are affected by CVE-2026-25737?
Budibase versions up to and including 3.24.0 are affected by CVE-2026-25737.
What are the potential impacts of CVE-2026-25737?
The exploitation of CVE-2026-25737 can lead to unauthorized access to sensitive data, server manipulation, and execution of malicious scripts within the application.
Is there a workaround for CVE-2026-25737 if I cannot upgrade immediately?
A temporary workaround for CVE-2026-25737 includes manually restricting file uploads to specific types and implementing additional validation checks on uploaded files.