Read the docs
TI-2026-20226 Aliases CVE-2026-25041GHSA-726g-59wr-cj4c

Budibase has a Command Injection in PostgreSQL Dump Command

Priority MEDIUM 40CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.23.22 and earlier, the PostgreSQL integration constructs shell commands using user-controlled configuration values (database name, host, password, etc.) without proper sanitization. The password and other connection parameters are directly interpolated into a shell command. This affects packages/server/src/integrations/postgres.ts.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00546 46th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed @budibase/server (npm): 3.23.32

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Budibasebudibaseup to 3.23.22—No fix listedCNA
—@budibase/server (npm)before 3.23.323.23.32Patch availableGHSA-726g-59wr-cj4c
  • budibase VendorBudibase Affected up to 3.23.22 Fixed in — No fix listed CNA
  • @budibase/server (npm) Vendor— Affected before 3.23.32 Fixed in 3.23.32 Patch available GHSA-726g-59wr-cj4c

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:*up to 3.23.22VulnerableBudibase
  • cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:* Versions up to 3.23.22 Vulnerable ·Budibase

Remediation

  • Fix · GHSA-726g-59wr-cj4c @budibase/server (npm) Fixed in 3.23.32 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25041
  2. 2026-10-03 Alias added: GHSA-726g-59wr-cj4c

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2026-39242 Budibase: Anonymous NoSQL operator injection via published-app query templates CVSS 3.1CRITICAL 10.0
  • TI-2026-24369 Budibase Universal Auth Bypass via Webhook Query Param Injection CVSS 3.1CRITICAL 9.1
  • TI-2026-39244 Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload CVSS 3.1CRITICAL 9.6
  • TI-2026-39243 Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override CVSS 3.1CRITICAL 9.6
  • TI-2026-24371 Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist CVSS 3.1CRITICAL 9.9
  • TI-2026-23473 Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets CVSS 3.1CRITICAL 9.6
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences