DeutschShown in its original language — a full translation is planned for a future version.
Budibase: Mehrere Schwachstellen
view advisory published 2026-04-07
Ein Angreifer kann mehrere Schwachstellen in Budibase ausnutzen, um beliebigen Code auszuführen – sogar mit Root-Rechten –, sich erweiterte Rechte zu verschaffen – sogar Administratorrechte –, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, einen Denial-of-Service-Zustand herbeizuführen oder vertrauliche Informationen offenzulegen.
01
describes (7)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-35218US | — | — | ||
Budibase is an open-source low-code platform. Prior to version 3.32.5, Budibase's Builder Command Palette renders entity names (tables, views, queries, automations) using Svelte's… | ||||
| CVE-2026-35216US | — | — | ||
Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an a… | ||||
| CVE-2026-35214US | — | — | ||
Budibase is an open-source low-code platform. Prior to version 3.33.4, the plugin file upload endpoint (POST /api/plugin/upload) passes the user-supplied filename directly to creat… | ||||
| CVE-2026-31818US | critical9.9OT elevated | — | ||
Budibase is an open-source low-code platform. Prior to version 3.33.4, a server-side request forgery (SSRF) vulnerability exists in Budibase's REST datasource connector. The platfo… | ||||
| CVE-2026-25044US | high8.8 | — | ||
Budibase is an open-source low-code platform. Prior to version 3.33.4, the bash automation step executes user-provided commands using execSync without proper sanitization or valida… | ||||
| CVE-2026-25043US | high7.5 | — | ||
Budibase is an open-source low-code platform. Prior to version 3.23.25, a business logic vulnerability exists in Budibase’s password reset functionality due to the absence of rate… | ||||
| CVE-2026-25040US | high8.8OT elevated | — | ||
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions up to and including 3.26.3, a Creator-level user, who normally has no UI permi… | ||||
02
references
External citations — patches, advisories, analysis.
- GitHub Security Advisory GHSA-gp5x-2v54-v2q5 vom 2026-04-07external
- GitHub Security Advisory GHSA-2wfh-rcwf-wh23 vom 2026-04-07external
- GitHub Security Advisory GHSA-gp5x-2v54-v2q5 vom 2026-04-07external
- GitHub Security Advisory GHSA-fcm4-4pj2-m5hf vom 2026-04-07external
- GitHub Security Advisory GHSA-gp5x-2v54-v2q5 vom 2026-04-07external
- GitHub Security Advisory GHSA-2wfh-rcwf-wh23 vom 2026-04-07external
- GitHub Security Advisory GHSA-7r9j-r86q-7g45 vom 2026-04-07external
- GitHub Security Advisory GHSA-fcm4-4pj2-m5hf vom 2026-04-07external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan