CVE-2026-73307: Budibase: SSRF via bare fetch() in uploadUrl during AI table generation
Budibase is an open-source low-code platform. Prior to 3.39.4, uploadUrl in packages/server/src/utilities/fileUtils.ts used a bare server-side fetch for string attachment values passed by processAttachments in packages/server/src/sdk/workspace/ai/helpers/rows.ts. A builder with the AI table-generation feature could cause an attachment value to reference an internal service or cloud metadata endpoint, and the response would be stored as an attachment without fetchWithBlacklist validation. This issue is fixed in version 3.39.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibaseto a version that resolves this vulnerability.Fixed in 3.39.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73307?
The severity of CVE-2026-73307 is rated at risk 47.
How do I fix CVE-2026-73307?
To fix CVE-2026-73307, upgrade Budibase to version 3.39.4 or later.
What vulnerability type is CVE-2026-73307 classified as?
CVE-2026-73307 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
Which component is affected by CVE-2026-73307?
CVE-2026-73307 affects the uploadUrl function in Budibase's file utilities.
When was CVE-2026-73307 published?
CVE-2026-73307 was published on August 12, 2026.