Arbitrary File Upload Vulnerability in Budibase Low Code Platform
CVE-2026-25737

8.9HIGH

Key Information:

Vendor

Budibase

Status
Budibase
Vendor
CVE Published:
9 March 2026

What is CVE-2026-25737?

Budibase, a popular low code platform for creating internal tools and workflows, has a vulnerability that allows for arbitrary file uploads. This issue arises in versions 3.24.0 and earlier, where file extension restrictions are only enforced at the user interface level. Consequently, an attacker can exploit this weakness to bypass these restrictions and upload malicious files, potentially leading to severe security breaches. Organizations utilizing Budibase should assess their versions and apply necessary security measures to safeguard against these threats.

Affected Version(s)

budibase <= 3.24.0

References

https://github.com/Budibase/budibase/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.