CVE-2026-73307

Received Received - Intake

Remote Code Execution in Budibase via Malicious Attachment Handling

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

Budibase is an open-source low-code platform. Prior to 3.39.4, uploadUrl in packages/server/src/utilities/fileUtils.ts used a bare server-side fetch for string attachment values passed by processAttachments in packages/server/src/sdk/workspace/ai/helpers/rows.ts. A builder with the AI table-generation feature could cause an attachment value to reference an internal service or cloud metadata endpoint, and the response would be stored as an attachment without fetchWithBlacklist validation. This issue is fixed in version 3.39.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-73307

EUVD

EUVD-2026-57430

Affected Vendors & Products

Vendor	Product	Version / Range
budibase	budibase	3.39.4
budibase	budibase	to 3.40.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

CVE-2026-73307 is a Server-Side Request Forgery (SSRF) vulnerability in Budibase's AI table generation feature. It occurs because the uploadUrl function used a bare fetch call without security checks to download content. This allowed attackers with builder access to craft URLs pointing to internal services or cloud metadata endpoints, which the server would then fetch and store as attachments. The issue was fixed by replacing the raw fetch with a blacklist-protected fetch method called fetchWithBlacklist.

Detection Guidance

To detect this vulnerability, check if your Budibase instance is running a version prior to 3.39.4. Use commands like 'curl -s https://your-budibase-instance.com/api/version' or inspect the server logs for AI table generation errors. Verify if the uploadUrl function in fileUtils.ts uses fetchWithBlacklist for remote downloads.

Impact Analysis

An attacker with builder-level access could exploit this to make unauthorized requests to internal systems or cloud metadata APIs. This could lead to exfiltration of sensitive data like AWS IAM credentials or enable internal service enumeration. The impact is limited to the AI table generation feature and requires builder access to trigger.

Compliance Impact

This vulnerability could lead to unauthorized access to internal systems or cloud metadata, potentially exposing sensitive data. This may violate compliance requirements for data protection and privacy such as GDPR or HIPAA, depending on the data accessed. Organizations using affected Budibase versions should apply the patch to maintain compliance.

Mitigation Strategies

Upgrade Budibase to version 3.39.4 or later immediately. If upgrading is not possible, manually patch the uploadUrl function in fileUtils.ts to use fetchWithBlacklist instead of raw fetch. Restrict builder-level access to AI table generation features to reduce attack surface.

Hi! I’m here to help you understand CVE-2026-73307. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70