CVEvulnerability

CVE-2026-25737

9.0 CRITICAL Published 2026-03-09 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-03-09
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.9 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
CVSS 3.1 ([email protected])
9.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-602, CWE-79, CWE-918

Description

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.24.0 and earlier, an arbitrary file upload vulnerability exists even though file extension restrictions are configured. The restriction is enforced only at the UI level. An attacker can bypass these restrictions and upload malicious files.

Affected configurations

• budibase budibase (<= 3.24.0)

Related

Weakness · CWE (3)

  • CWE-602 Client-Side Enforcement of Server-Side Security weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-918 Server-Side Request Forgery weakness

References