CVE-2026-54356
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Budibase prior to version 3.41.3 has a vulnerability in the POST /api/attachments/:datasourceId/url endpoint, where an authenticated published-app user with the BASIC role can supply attacker-controlled bucket and key values and obtain signedUrl and publicUrl values backed by stored S3 datasource credentials.
Risk Assessment
A low-privileged user could gain access to S3 resources, potentially leading to data leakage or unauthorized access to stored files.
Recommendation
Upgrade Budibase to version 3.41.3, which contains the fix.
Original NVD description (English source)
Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled bucket and key values and obtain signedUrl and publicUrl values backed by stored S3 datasource credentials. This issue is fixed in version 3.41.3.