budibase up to 3.38.1 File Upload Endpoint /api/attachments/process cross site scripting

Summaryinfo

A vulnerability has been found in budibase up to 3.38.1 and classified as problematic. This affects an unknown function of the file /api/attachments/process of the component File Upload Endpoint. Performing a manipulation results in cross site scripting. This vulnerability is known as CVE-2026-46426. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in budibase up to 3.38.1. It has been classified as problematic. This affects an unknown part of the file /api/attachments/process of the component File Upload Endpoint. The manipulation with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. The summary by CVE is:

Budibase is an open-source low-code platform. Prior to 3.38.2, the file upload endpoint POST /api/attachments/process does not enforce active-content restrictions for authenticated users. The checks for dangerous file extensions are conditionally wrapped inside if (isPublicUser) or if (isPublicUser || !env.SELF_HOSTED), meaning any authenticated builder can upload executable web content — SVG files with inline tags, HTML pages with JavaScript, .js modules — which are then stored in the object store (MinIO/S3) with their correct MIME types. When the resulting signed URL is opened by any app user, the browser executes the payload. Impact is persistent stored XSS over all application end users. This vulnerability is fixed in 3.38.2.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-46426 since 05/14/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

Upgrading to version 3.38.2 eliminates this vulnerability. The upgrade is hosted for download at github.com.

The vulnerability is also documented in the databases at EUVD (EUVD-2026-32596) and CERT Bund (WID-SEC-2026-1564). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Open Source Budibase

Productinfo

Name

• budibase

Version

• 3.38.0
• 3.38.1

Website

• Product: https://github.com/Budibase/budibase/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion