CVE-2026-73408 in Budibase
Summary
by MITRE • 08/14/2026
Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait for a Budibase administrator to run schema discovery, causing the second statement to execute. The fix applies quoteMySqlIdentifier before constructing the query. This issue is fixed in version 3.39.18.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability identified in Budibase versions prior to 3.39.18 represents a critical SQL injection flaw that leverages unsafe query construction practices within the MySQL integration component. This security weakness resides in the packages/server/src/integrations/mysql.ts file where the multipleStatements parameter is enabled, creating an environment conducive to stacked query execution attacks. The root cause stems from the improper handling of user-provided table names when constructing DESCRIBE statements, specifically failing to properly escape identifiers before incorporating them into database queries.
The technical implementation of this vulnerability exploits the MySQL feature that allows multiple SQL statements to be executed in a single query when multipleStatements is enabled. When an attacker creates a MySQL table with a name containing backticks and embedded SQL commands, the system's schema discovery process becomes a vector for arbitrary code execution. The unescaped tableName variable directly influences the DESCRIBE statement construction, enabling attackers to inject malicious SQL that executes upon administrator interaction with the platform's database schema features.
This vulnerability impacts the integrity and confidentiality of database systems by potentially allowing attackers to execute unauthorized commands against the MySQL server. The operational impact extends beyond simple data theft as it could enable privilege escalation, data manipulation, or even complete system compromise depending on the database user's permissions. The attack requires minimal prerequisites since it only necessitates table creation capabilities within the MySQL environment, making it particularly dangerous in multi-tenant or shared hosting scenarios.
The security implications align with CWE-89, which categorizes SQL injection vulnerabilities as a fundamental weakness in software design that enables attackers to manipulate database queries through untrusted input. This flaw also maps to ATT&CK technique T1078 for valid accounts and T1566 for phishing attacks, as the vulnerability relies on legitimate administrative actions to execute malicious code. The fix implemented in version 3.39.18 addresses this by applying proper MySQL identifier quoting through the quoteMySqlIdentifier function, ensuring that all user-provided identifiers are safely escaped before query construction.
Organizations using affected Budibase versions should immediately implement mitigations including disabling the problematic integration features until the upgrade is complete, monitoring for unauthorized table creation activities, and verifying database user permissions to limit potential damage. The remediation strategy must also include comprehensive testing of the patched version to ensure that legitimate functionality remains intact while addressing the security gap. This vulnerability underscores the critical importance of proper input sanitization and parameterized queries in database interactions, particularly when dealing with dynamic identifier construction in low-code platforms where automated query generation may introduce unexpected security risks.