CVE-2026-25737:

Arbitrary file upload vulnerability in Budibase 3.24.0 and earlier allows attackers to bypass file extension restrictions and upload malicious files.

Score
A numerical rating that indicates how dangerous this vulnerability is.

9.0Critical

Published Date:Mar 9, 2026
CISA KEV Date:*No Data*
Industries Affected:20

Threat Predictions

EPSS Score:0.1
EPSS Percentile:19%

Exploitability

Score:2.3
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:LOW
User Interaction:REQUIRED
Scope:CHANGED

Impact

Score:6.0
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

Arbitrary file upload vulnerability in Budibase 3.24.0 and earlier allows attackers to bypass file extension restrictions and upload malicious files.

Overview

The vulnerability in Budibase affects versions 3.24.0 and earlier. It stems from inadequate implementation of file extension restrictions, which are only enforced at the user interface level. This oversight allows malicious actors to circumvent these restrictions and upload arbitrary files, including those with potentially harmful content. The vulnerability has been assigned a CVSS v3.1 base score of 8.9, indicating a high severity level. The attack vector is network-based, requires low attack complexity, and low privileges. User interaction is necessary for exploitation, and the scope is changed. The potential impact includes high confidentiality and integrity breaches, with a low impact on availability.

Remediation

To mitigate this vulnerability, users of Budibase should take the following steps:
1. Update to the latest version of Budibase as soon as it becomes available.
2. Implement server-side validation of file uploads to ensure that file extension restrictions are enforced beyond the UI level.
3. Employ additional security measures such as file type checking, content validation, and virus scanning for all uploaded files.
4. Monitor system logs for any suspicious file upload activities.
5. Restrict file upload permissions to trusted users only.
6. Consider implementing a web application firewall (WAF) to provide an additional layer of protection against malicious file uploads.