Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Release: budibase server 3.40.0 Clear all filters
TI-2026-51080 CVE-2026-72855 · GHSA-9x7q-v2pf-x72v

Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST

Priority HIGH 70

Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebi…

CVSS 4.0HIGH 8.4 Network Low privileges No interaction EPSS 0.00375 Published 2026-08-13 Fixed in 3.40.0 CWE-918
TI-2026-51076 CVE-2026-72851 · GHSA-x389-5jg5-q6vh

Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook

Priority HIGH 80

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps.

CVSS 4.0CRITICAL 9.0 Network Low privileges No interaction EPSS 0.00356 Published 2026-08-13 Fixed in 3.40.0 CWE-89
TI-2026-51075 CVE-2026-72850 · GHSA-ccjw-whgg-h4gh

Budibase before 3.40.0 Arbitrary File Write via Path Traversal

Priority HIGH 76

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export.

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.00518 Published 2026-08-13 Fixed in 3.40.0 CWE-22
TI-2026-51074 CVE-2026-72849 · GHSA-4q4m-8h83-fcmr

Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF

Priority LOW 37

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account.

CVSS 4.0HIGH 8.7 Network Low privileges User interaction EPSS 0.00162 Published 2026-08-13 Fixed in 3.40.0 CWE-352
TI-2026-51702 CVE-2026-73618 · GHSA-wg7g-xr7v-hf69

Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter

Priority HIGH 73

Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00362 Published 2026-08-13 Fixed in 3.40.0 CWE-943
TI-2026-51701 CVE-2026-73617 · GHSA-rqxq-f5cc-3xp6

Budibase before 3.40.0 NoSQL Injection via MongoDB datasource

Priority LOW 31

Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filteri…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00343 Published 2026-08-13 Fixed in 3.40.0 CWE-943