Most recent entries from all

EUVD-2026-354881

2026-10-03T07:50:23.796300+00:00

EUVD-2026-354881

fkie_cve-2026-54356

2026-10-03T07:50:23.796335+00:00

Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled bucket and key values and obtain signedUrl and publicUrl values backed by stored S3 datasource credentials. This issue is fixed in version 3.41.3.

GHSA-6x9p-4r67-5gjx — Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`

2026-10-03T07:50:23.796370+00:00

Affected: npm: @budibase/server

### Summary Budibase 3.39.7 allows a low-privilege authenticated published-app user with the built-in BASIC role to obtain arbitrary S3 pre-signed upload URLs backed by a workspace datasource's stored server-side credentials.

The affected endpoint is:

`POST /api/attachments/:datasourceId/url`

The caller can control: ```text bucket key ``` and receives: ```text signedUrl publicUrl ```

This lets a low-privilege published-app user mint S3 `PUT` URLs using server-side datasource credentials for attacker-chosen object destinations.

Steps:

1. Log in as an admin user. 2. Create a new app/workspace. 3. In the development app context, create an S3 datasource with valid credentials. 4. Publish the app. 5. Create a low-privilege user with the built-in BASIC role on the published production app ID. 6. Log in as that BASIC user. 7. Send: `POST /api/attachments//url`

with: ```json {"bucket":"foo","key":"bar"} ``` and the published app header: ```text x-budibase-app-id: ``` Observe a successful response containing: ```text signedUrl publicUrl ```

### Observed result

The following behavior:

dev BASIC request: 403 User does not have permission app publish: SUCCESS prod BASIC request: 200 OK Example confirmed runtime values from the final successful run: ```text prodAppId: app_e6b4cdc6cd6949969a83ff11eee88c5a datasourceId: datasource_0cec491b26a742468257c62382aa3284 publicUrl: https://foo.s3.eu-west-1.amazonaws.com/bar ``` The returned signedUrl cont…

WID-SEC-W-2026-2849 — Budibase: Mehrere Schwachstellen

2026-10-03T07:50:23.796421+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Budibase ausnutzen, um Dateien zu manipulieren, vertrauliche Daten offenzulegen, erweiterte Berechtigungen zu erlangen und Sicherheitsmaßnahmen zu umgehen.