CVE-2026-25737

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25737", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-05T16:48:00.427Z", "datePublished": "2026-03-09T20:08:32.067Z", "dateUpdated": "2026-03-09T20:34:21.618Z"}, "containers": {"cna": {"title": "Budibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS)", "problemTypes": [{"descriptions": [{"cweId": "CWE-602", "lang": "en", "description": "CWE-602: Client-Side Enforcement of Server-Side Security", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.9, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/Budibase/budibase/security/advisories/GHSA-2hfr-343j-863r", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-2hfr-343j-863r"}], "affected": [{"vendor": "Budibase", "product": "budibase", "versions": [{"version": "<= 3.24.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-09T20:08:32.067Z"}, "descriptions": [{"lang": "en", "value": "Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.24.0 and earlier, an arbitrary file upload vulnerability exists even though file extension restrictions are configured. The restriction is enforced only at the UI level. An attacker can bypass these restrictions and upload malicious files."}], "source": {"advisory": "GHSA-2hfr-343j-863r", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25737", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-09T20:31:10.330931Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T20:34:21.618Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25737", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-09T20:31:10.330931Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T20:31:35.682Z"}}], "cna": {"title": "Budibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS)", "source": {"advisory": "GHSA-2hfr-343j-863r", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.9, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Budibase", "product": "budibase", "versions": [{"status": "affected", "version": "<= 3.24.0"}]}], "references": [{"url": "https://github.com/Budibase/budibase/security/advisories/GHSA-2hfr-343j-863r", "name": "https://github.com/Budibase/budibase/security/advisories/GHSA-2hfr-343j-863r", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.24.0 and earlier, an arbitrary file upload vulnerability exists even though file extension restrictions are configured. The restriction is enforced only at the UI level. An attacker can bypass these restrictions and upload malicious files."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-602", "description": "CWE-602: Client-Side Enforcement of Server-Side Security"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-09T20:08:32.067Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25737", "state": "PUBLISHED", "dateUpdated": "2026-03-09T20:34:21.618Z", "dateReserved": "2026-02-05T16:48:00.427Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-09T20:08:32.067Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "budibase", "vendor": "Budibase", "versions": [{"status": "affected", "version": "<= 3.24.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:*", "matchCriteriaId": "81D6E4C0-FDC0-425D-93BF-8BD9545F8B76", "versionEndIncluding": "3.24.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.24.0 and earlier, an arbitrary file upload vulnerability exists even though file extension restrictions are configured. The restriction is enforced only at the UI level. An attacker can bypass these restrictions and upload malicious files."}, {"lang": "es", "value": "Budibase es una plataforma de bajo c\u00f3digo para crear herramientas internas, flujos de trabajo y paneles de administraci\u00f3n. En la versi\u00f3n 3.24.0 y anteriores, existe una vulnerabilidad de carga arbitraria de archivos a pesar de que las restricciones de extensi\u00f3n de archivo est\u00e1n configuradas. La restricci\u00f3n se aplica solo a nivel de interfaz de usuario. Un atacante puede eludir estas restricciones y cargar archivos maliciosos."}], "id": "CVE-2026-25737", "lastModified": "2026-06-17T10:25:08.383", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.9, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25737", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T20:31:10.330931Z", "version": "2.0.3"}}]}, "published": "2026-03-09T21:16:15.340", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-2hfr-343j-863r"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-602"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-918"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.24.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "budibase", "source": "cna", "vendor": "Budibase"}, "product": "budibase", "vendor": "budibase"}], "analysis": {"en": {"generated_at": "2026-04-18T09:41:26.387207+00:00", "value": {"mitigation_remediation": ["Upgrade Budibase to a version newer than 3.24.0 that enforces file type checks on the server side.", "If an immediate upgrade is not possible, restrict the upload interface by disabling or removing the endpoint, or by applying a server\u2011side file type filter that rejects all non\u2011trusted extensions.", "Apply the latest security updates from the Budibase maintainers.", "Monitor application logs for anomalous file upload activity and block any suspicious traffic."], "summary": {"action": "Apply Patch", "impact": "Stored XSS and SSRF"}, "threat_synthesis": {"affected_systems": "The affected product is Budibase, specifically all releases 3.24.0 and earlier. Any deployment of these versions hosts the upload endpoint that enforces only client\u2011side restrictions, making them susceptible to the flaw.", "description_and_impact": "Budibase is a low\u2011code platform that in versions 3.24.0 and earlier suffered an arbitrary file upload flaw. Although administrators can configure file extension restrictions, the enforcement occurs only at the user interface, allowing an attacker to bypass the checks and upload malicious files. This flaw can lead to several high\u2011severity issues, including stored cross\u2011site scripting (CWE\u201179) and server\u2011side request forgery (CWE\u2011918), which can compromise confidentiality, integrity, or availability of the host. The CVSS score of 8.9 reflects the high impact of these consequences.", "risk_and_exploitability": "The CVSS score of 8.9 indicates a high severity, while the EPSS score of less than 1\u202f% suggests the likelihood of exploitation in the wild is currently low, and the vulnerability is not listed in CISA\u2019s KEV catalog. The attack vector is likely a web application access, requiring authenticated or unauthenticated users to reach the upload API. Successful exploitation would grant the attacker the ability to deliver malicious files that can lead to file inclusion, SSRF, or XSS, thereby compromising confidentiality, integrity, or availability of the host."}}}}, "created": "2026-03-10T14:07:09.137954+00:00", "updated": "2026-04-18T09:45:25.839951+00:00", "vendors": ["budibase", "budibase$PRODUCT$budibase"]}