Budibase: SSRF via bare fetch() in uploadUrl during AI table generation
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
Budibase is an open-source low-code platform. Prior to 3.39.4, uploadUrl in packages/server/src/utilities/fileUtils.ts used a bare server-side fetch for string attachment values passed by processAttachments in packages/server/src/sdk/workspace/ai/helpers/rows.ts. A builder with the AI table-generation feature could cause an attachment value to reference an internal service or cloud metadata endpoint, and the response would be stored as an attachment without fetchWithBlacklist validation. This issue is fixed in version 3.39.4.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Budibase | budibase | before 3.39.4 | 3.39.4 | Patch available | CNA |
| — | @budibase/server (npm) | up to 3.38.1 | — | No fix listed | GHSA-hfhx-w8p8-4hc7 |
- budibase VendorBudibase Affected before 3.39.4 Fixed in 3.39.4 Patch available CNA
- @budibase/server (npm) Vendor— Affected up to 3.38.1 Fixed in — No fix listed GHSA-hfhx-w8p8-4hc7
Remediation
- Fix · CNA budibase (Budibase) Fixed in 3.39.4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-73307
- 2026-10-03 Alias added: GHSA-hfhx-w8p8-4hc7
References
Other 6
- https://github.com/Budibase/budibase/security/advisories/GHSA-hfhx-w8p8-4hc7
- https://github.com/Budibase/budibase/pull/18866
- https://github.com/Budibase/budibase/commit/fc8161e739bdc5513c4314282251e327e7fe339f
- https://github.com/Budibase/budibase/releases/tag/3.39.4
- https://github.com/Budibase/budibase/commit/72e602d68daeebe3b95b0ed87acd351a38e327d7
- https://github.com/Budibase/budibase
More Budibase vulnerabilities
- TI-2026-39242 Budibase: Anonymous NoSQL operator injection via published-app query templates CVSS 3.1CRITICAL 10.0
- TI-2026-51076 Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook CVSS 4.0CRITICAL 9.0
- TI-2026-24369 Budibase Universal Auth Bypass via Webhook Query Param Injection CVSS 3.1CRITICAL 9.1
- TI-2026-56709 Budibase before 3.41.3 Remote Code Execution via Plugin eval() CVSS 4.0CRITICAL 9.4
- TI-2026-51425 Budibase: SQL Injection via `multipleStatements: true` CVSS 3.1CRITICAL 9.6
- TI-2026-51075 Budibase before 3.40.0 Arbitrary File Write via Path Traversal CVSS 4.0CRITICAL 9.4
Sources
- CVE-2026-73307 · CVE Program
- CVE-2026-73307 · NVD
- FIRST EPSS
- GHSA-hfhx-w8p8-4hc7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences