https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T15:09:18.260241+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-45548 CVE-2026-45548 — Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation 2026-10-12T15:09:18.273715+00:00

Affected: budibase

Budibase is an open-source low-code platform. Prior to 3.34.8, the processUrlFile function in packages/server/src/automations/steps/ai/extract.ts uses fetch(fileUrl) directly without the IP blacklist validation that is consistently applied to all other automation steps. This allows an authenticated user to trigger server-side requests to internal network addresses. This vulnerability is fixed in 3.34.8.