CVE-2026-46426: Budibase: Unrestricted Upload of File with Dangerous Type

Synopsis

Unrestricted file upload in Budibase, the open-source low-code platform, allows any authenticated builder to upload active web content (SVG files with embedded scripts, HTML pages, JavaScript modules) through the attachment processing endpoint. The endpoint skips dangerous-extension checks for authenticated users, so the uploaded files are stored in object storage with their original MIME types and served back via signed URLs. When any app user opens such a URL, the browser executes the payload, resulting in persistent stored cross-site scripting (XSS) across all application end users. No fix version has been published yet; HarborGuard is tracking the upstream advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Budibase attachment endpoint over the network; the service must be exposed to the attacker's network.

• AuthenticationRequired

  A low-privilege authenticated account with builder access is sufficient; no admin credentials are needed.

• Victim interactionRequired

  A victim app user must open the signed URL to the malicious file, triggering execution in their browser.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or special memory layout are required to trigger the upload and subsequent XSS execution.

Blast Radius

• The attacker stores a persistent malicious payload in the object store (MinIO or S3) that executes in the browser of every app user who opens the affected signed URL.
• Session tokens, cookies, and any data visible in the victim's browser session are exposed to the attacker.
• The attacker can make authenticated requests on behalf of victims, potentially reading or modifying application data within the scope of each victim's permissions.