CVE Explorer

CVE-2026-25737

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.24.0 and earlier, an arbitrary file upload vulnerability exists even though file extension restrictions are configured. The restriction is enforced only at the UI level. An attacker can bypass these restrictions and upload malicious files.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:bffcf771592fe9d3beaf780ea1610ba6f1e76305dff3248b83fe6e0da164e4a1

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"budibase","vendor":"Budibase","versions":[{"status":"affected","version":"<= 3.24.0"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:c47d43bdbd64c174c4c59e6c848a994ef6dd2778e47d0bad1054d7faa1a96c31 · sha256:7c8244aaaf7b194c… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.9,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:c47d43bdbd64c174c4c59e6c848a994ef6dd2778e47d0bad1054d7faa1a96c31 · sha256:7c8244aaaf7b194c… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-602","description":"CWE-602: Client-Side Enforcement of Server-Side Security","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:c47d43bdbd64c174c4c59e6c848a994ef6dd2778e47d0bad1054d7faa1a96c31 · sha256:7c8244aaaf7b194c… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion

{"name":"https://github.com/Budibase/budibase/security/advisories/GHSA-2hfr-343j-863r","tags":["x_refsource_CONFIRM"],"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-2hfr-343j-863r"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:c47d43bdbd64c174c4c59e6c848a994ef6dd2778e47d0bad1054d7faa1a96c31 · sha256:7c8244aaaf7b194c… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer