CVE-2026-46426Disclosure

LOWCVSS 7.6 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Budibase is an open-source low-code platform. Prior to 3.38.2, the file upload endpoint POST /api/attachments/process does not enforce active-content restrictions for authenticated users. The checks for dangerous file extensions are conditionally wrapped inside if (isPublicUser) or if (isPublicUser || !env.SELF_HOSTED), meaning any authenticated builder can upload executable web content — SVG files with inline <script> tags, HTML pages with JavaScript, .js modules — which are then stored in the object store (MinIO/S3) with their correct MIME types. When the resulting signed URL is opened by any app user, the browser executes the payload. Impact is persistent stored XSS over all application end users. This vulnerability is fixed in 3.38.2.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-79CWE-434

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
2 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification2 categories

Disclosure

150.0%

Patch

150.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Infoflowcloud@infoflowcloud137d
Disclosure
🚨*CVE* CVE-2026-46426 Budibase is an open-source low-code platform. Prior to 3.38.2, the file upload endpoint POST /api/attachments/process does not enforce active-content restrictions for… https://www.cve.org/CVERecord?id=CVE-2026-46426 ----- Traducción: CVE-2026-46426 Bud… http://infoflow.cloud`
Post summary
The post announces CVE-2026-46426 for Budibase, indicating that its file‑upload endpoint lacks active‑content restrictions prior to version 3.38.2.
0000028
79 followersView on X
CVE@CVEnew137d
Patch
CVE-2026-46426 Budibase is an open-source low-code platform. Prior to 3.38.2, the file upload endpoint POST /api/attachments/process does not enforce active-content restrictions for… https://www.cve.org/CVERecord?id=CVE-2026-46426
Post summary
The text highlights CVE-2026-46426 in Budibase, describing an upload endpoint flaw before version 3.38.2 and indicating that the patch is addressed in 3.38.2.
00000152
57.5K followersView on X

Explore more

Back to dashboard