CVE-2026-46426 Details
Description
Budibase is an open-source low-code platform. Prior to 3.38.2, the file upload endpoint POST /api/attachments/process does not enforce active-content restrictions for authenticated users. The checks for dangerous file extensions are conditionally wrapped inside if (isPublicUser) or if (isPublicUser || !env.SELF_HOSTED), meaning any authenticated builder can upload executable web content — SVG files with inline <script> tags, HTML pages with JavaScript, .js modules — which are then stored in the object store (MinIO/S3) with their correct MIME types. When the resulting signed URL is opened by any app user, the browser executes the payload. Impact is persistent stored XSS over all application end users. This vulnerability is fixed in 3.38.2.
A stored cross-site scripting vulnerability has been identified in Budibase, an open-source low-code platform, prior to version 3.38.2. The issue arises in the file upload endpoint POST /api/attachments/process, which fails to properly restrict active content for authenticated users. The vulnerability allows authenticated builders to upload executable web files, such as SVGs with inline script tags, HTML files with JavaScript, and JavaScript modules. These files are stored in the object store (MinIO/S3) with their correct MIME types. When the signed URL for the uploaded file is accessed by any application user, the browser executes the embedded payload, leading to persistent stored cross-site scripting across all application end users.
Users can update to Budibase version 3.38.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 27, 2026CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Budibase/budibase/security/advisories/GHSA-82rc-gxrg-v4gf | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Budibase/budibase/releases/tag/3.38.2 | [email protected] | Release NotesVendor |
| https://github.com/Budibase/budibase/security/advisories/GHSA-82rc-gxrg-v4gf | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Budibase | < 3.38.2 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |