CVEvulnerability
CVE-2026-35216
9.0 CRITICAL
Official page ↗
- Status
- Analyzed
- Published
- 2026-04-03
- Last modified
- 2026-10-06
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.0 CRITICAL — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
- Weaknesses
- CWE-78
Description
Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authentication is required to trigger the exploit. The process executes as root inside the container. This issue has been patched in version 3.33.4.
Affected configurations
• budibase budibase (< 3.33.4)
Related
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- https://github.com/Budibase/budibase/commit/f0c731b409a96e401445a6a6030d2994ff4ac256 Patch
- https://github.com/Budibase/budibase/pull/18238 Issue Tracking, Patch
- https://github.com/Budibase/budibase/releases/tag/3.33.4 Product, Release Notes
- https://github.com/Budibase/budibase/security/advisories/GHSA-fcm4-4pj2-m5hf Exploit, Vendor Advisory
- https://github.com/Budibase/budibase/security/advisories/GHSA-fcm4-4pj2-m5hf Exploit, Vendor Advisory