CVE-2026-25737

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.24.0 and earlier, an arbitrary file upload vulnerability exists even though file extension restrictions are configured. The restriction is enforced only at the UI level. An attacker can bypass these restrictions and upload malicious files.

• CWE-602
• CWE-79
• CWE-918

• https://github.com/Budibase/budibase/security/advisories/GHSA-2hfr-343j-863rExploit, Vendor Advisory

Published

Mar 9, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25731calibre is an e-book manager. Prior to 9.2.0, a Server-Side …7.8
• CVE-2026-25732NiceGUI is a Python-based UI framework. Prior to 3.7.0, Nice…7.5
• CVE-2026-25733Rucio is a software framework that provides functionality to…5.4
• CVE-2026-25734Rucio is a software framework that provides functionality to…4.8
• CVE-2026-25735Rucio is a software framework that provides functionality to…4.8
• CVE-2026-25736Rucio is a software framework that provides functionality to…4.8
• CVE-2026-25738Indico is an event management system that uses Flask-Multipa…4.3
• CVE-2026-25739Indico is an event management system that uses Flask-Multipa…5.4
• CVE-2026-25740captive browser, a dedicated Chrome instance to log into cap…5.8
• CVE-2026-25741Zulip is an open-source team collaboration tool. Prior to co…7.1
• CVE-2026-25742Zulip is an open-source team collaboration tool. Prior to ve…5.3
• CVE-2026-25743OpenEMR is a free and open source electronic health records …4.8