Budibase Vulnerability: Critical CVE-2026-72850 and CVE-2026-72851
- Severity
- CRITICAL
- CVSS
- 9.1
- Affected component
- budibase (npm)
- Affected versions
- < 3.38.1 or <= 3.30.6 or < 3.39.0 or < 3.38.2 or < 3.39.19 or < 3.30.4 or < 3.35.10
- Patched version
- 3.40.0
Budibase versions before 3.40.0 are reportedly vulnerable to critical security flaws that could allow authenticated builders to perform arbitrary file writes and unauthenticated SQL injection attacks.
What happened
Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. This could enable attackers to write arbitrary content to any path writable by the Budibase process.
Additionally, Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers could potentially inject SQL payloads that execute with builder-configured database credentials, enabling data exfiltration, modification, and persistence in connected datasources.
What to do about it
- Upgrade to Budibase 3.40.0 or later to mitigate the risk of arbitrary file writes.
- Review and secure webhook-triggered automations to prevent unauthenticated SQL injection attacks.
- Monitor the primary sources for updates on these vulnerabilities and any additional mitigation steps that may be recommended.
How 0Day would have caught this
budibase is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using Budibase versions < 3.38.1, <= 3.30.6, < 3.39.0, < 3.38.2, < 3.39.19, < 3.30.4, or < 3.35.10.
What should I do right now?
Upgrade to Budibase 3.40.0 or later immediately to mitigate the risk of these vulnerabilities.
Are these vulnerabilities being exploited in the wild?
There is no confirmed evidence that these vulnerabilities are being exploited in the wild at this time. However, it is crucial to apply the recommended mitigations promptly.