EUVD-2026-330852

fkie_cve-2026-50136

Budibase is an open-source low-code platform. Prior to 3.39.3, the application server exposes an unauthenticated endpoint that generates S3 PutObject presigned URLs using credentials stored in a workspace datasource. The route is protected only by the recaptcha middleware and does not require authentication, table permission, datasource permission, or builder access. A public caller who knows a workspace ID and S3 datasource ID can request a signed upload URL for attacker-controlled bucket and key values. This vulnerability is fixed in 3.39.3.

GHSA-jj36-r9w3-3pfh — Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials

Affected: npm: @budibase/server

The application server exposes an unauthenticated endpoint that generates S3 `PutObject` presigned URLs using credentials stored in a workspace datasource. The route is protected only by the recaptcha middleware and does not require authentication, table permission, datasource permission, or builder access. A public caller who knows a workspace ID and S3 datasource ID can request a signed upload URL for attacker-controlled bucket and key values.

### Details

The static route registers the signed upload URL endpoint with only `recaptcha` before the controller:

- `packages/server/src/api/routes/static.ts:44-48`

```ts 44: .post( 45: "/api/attachments/:datasourceId/url", 46: recaptcha, 47: controller.getSignedUploadURL 48: ) ```

The controller loads the datasource by `datasourceId` with enriched secret values:

- `packages/server/src/api/controllers/static/index.ts:590-598`

```ts 590:export const getSignedUploadURL = async function ( 591: ctx: Ctx<GetSignedUploadUrlRequest, GetSignedUploadUrlResponse> 592:) { 593: // Ensure datasource is valid 594: let datasource 595: try { 596: const { datasourceId } = ctx.params 597: datasource = await sdk.datasources.get(datasourceId, { enriched: true }) 598: if (!datasource) { ```

The request body controls `bucket` and `key`, and the server signs a PUT URL using the stored datasource credentials:

- `packages/server/src/api/controllers/static/index.ts:609-629`

```ts 609: if (datasource?.source === "S3") { 610:…

WID-SEC-W-2026-1714 — Budibase: Mehrere Schwachstellen ermöglichen Manipulation von Dateien

Ein Angreifer kann mehrere Schwachstellen in Budibase ausnutzen, um Dateien zu manipulieren.

Most recent entries from all

EUVD-2026-330852

fkie_cve-2026-50136

GHSA-jj36-r9w3-3pfh — Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials

WID-SEC-W-2026-1714 — Budibase: Mehrere Schwachstellen ermöglichen Manipulation von Dateien