CVE-2026-54356: Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`
Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled bucket and key values and obtain signedUrl and publicUrl values backed by stored S3 datasource credentials. This issue is fixed in version 3.41.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibaseto a version that resolves this vulnerability.Fixed in 3.41.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54356?
CVE-2026-54356 has a high severity rating of 7.1.
How do I fix CVE-2026-54356?
To fix CVE-2026-54356, update Budibase to version 3.41.3 or later.
What is the risk score of CVE-2026-54356?
CVE-2026-54356 has a risk score of 48.
Who is affected by CVE-2026-54356?
CVE-2026-54356 affects authenticated users with the BASIC role in Budibase prior to version 3.41.3.
What type of vulnerability is CVE-2026-54356?
CVE-2026-54356 is an authenticated arbitrary S3 signed upload URL issuance vulnerability.