CVE-2026-46426

Budibase is an open-source low-code platform. Prior to 3.38.2, the file upload endpoint POST /api/attachments/process does not enforce active-content restrictions for authenticated users. The checks for dangerous file extensions are conditionally wrapped inside if (isPublicUser) or if (isPublicUser || !env.SELF_HOSTED), meaning any authenticated builder can upload executable web content — SVG files with inline <script> tags, HTML pages with JavaScript, .js modules — which are then stored in the object store (MinIO/S3) with their correct MIME types. When the resulting signed URL is opened by any app user, the browser executes the payload. Impact is persistent stored XSS over all application end users. This vulnerability is fixed in 3.38.2.

• CWE-79
• CWE-434

• https://github.com/Budibase/budibase/releases/tag/3.38.2
• https://github.com/Budibase/budibase/security/advisories/GHSA-82rc-gxrg-v4gf
• https://github.com/Budibase/budibase/security/advisories/GHSA-82rc-gxrg-v4gf

Published

May 27, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46419Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0…7.5
• CVE-2026-46420setup-php is a GitHub action to set up PHP with extensions, …5.6
• CVE-2026-46421The SAP Cloud Application Programming Model is a tool for bu…9.3
• CVE-2026-46423Rocket.Chat is an open-source, secure, fully customizable co…9.3
• CVE-2026-46424Budibase is an open-source low-code platform. Prior to 3.38.…4.2
• CVE-2026-46425Budibase is an open-source low-code platform. Prior to 3.38.…9.9
• CVE-2026-46427Budibase is an open-source low-code platform. Prior to 3.38.…7.7
• CVE-2026-46428lettre is a a mailer library for Rust. Starting in version 0…9.1
• CVE-2026-4643Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to…3.5
• CVE-2026-46430Algernon is a small self-contained pure-Go web server. Prior…4.3
• CVE-2026-46431Algernon is a small self-contained pure-Go web server. Prior…4.3
• CVE-2026-46432LMDeploy is a toolkit for compressing, deploying, and servin…7.8