Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Budibase is an open-source low-code platform. Prior to 3.34.8, the processUrlFile function in packages/server/src/automations/steps/ai/extract.ts uses fetch(fileUrl) directly without the IP blacklist validation that is consistently applied to all other automation steps. This allows an authenticated user to trigger server-side requests to internal network addresses. This vulnerability is fixed in 3.34.8.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
CVE-2026-45548 Budibase is an open-source low-code platform. Prior to 3.34.8, the processUrlFile function in packages/server/src/automations/steps/ai/extract.ts uses fetch(fileUrl) … https://www.cve.org/CVERecord?id=CVE-2026-45548
Post summary
CVE-2026-45548 targets Budibase’s processUrlFile function before version 3.34.8, and the issue is addressed in the newer release. No PoC, exploit, or active use has been reported.
🔴 Budibase, Server-Side Request Forgery (SSRF), #CVE-2026-45548 (Critical) -DC-Jun2026-572 https://dailycve.com/budibase-server-side-request-forgery-ssrf-cve-2026-45548-critical-dc-jun2026-572/
Post summary
The post announces a critical SSRF vulnerability (CVE-2026-45548) affecting Budibase.