Lookup for vulnerable packages by Package URL.
| Purl | pkg:npm/%40budibase/server@2.6.26 |
| Type | npm |
| Namespace | @budibase |
| Name | server |
| Version | 2.6.26 |
| Qualifiers |
|
| Subpath | |
| Is_vulnerable | true |
| Next_non_vulnerable_version | 3.33.4 |
| Latest_non_vulnerable_version | 3.38.1 |
| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-dhet-rmkd-pqh6 |
| vulnerability_id |
VCID-dhet-rmkd-pqh6 |
| summary |
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.23.22 and earlier, the PostgreSQL integration constructs shell commands using user-controlled configuration values (database name, host, password, etc.) without proper sanitization. The password and other connection parameters are directly interpolated into a shell command. This affects packages/server/src/integrations/postgres.ts. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-25041, GHSA-726g-59wr-cj4c
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-dhet-rmkd-pqh6 |
|
| 1 |
| url |
VCID-g5dd-gava-87ab |
| vulnerability_id |
VCID-g5dd-gava-87ab |
| summary |
Budibase is an open-source low-code platform. Prior to version 3.33.4, the plugin file upload endpoint (POST /api/plugin/upload) passes the user-supplied filename directly to createTempFolder() without sanitizing path traversal sequences. An attacker with Global Builder privileges can craft a multipart upload with a filename containing ../ to delete arbitrary directories via rmSync and write arbitrary files via tarball extraction to any filesystem path the Node.js process can access. This issue has been patched in version 3.33.4. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-35214, GHSA-2wfh-rcwf-wh23
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-g5dd-gava-87ab |
|
| 2 |
| url |
VCID-kfvy-pknt-qbgv |
| vulnerability_id |
VCID-kfvy-pknt-qbgv |
| summary |
Budibase is an open-source low-code platform. Prior to version 3.33.4, the bash automation step executes user-provided commands using execSync without proper sanitization or validation. User input is processed through processStringSync which allows template interpolation, potentially allowing arbitrary command execution. This issue has been patched in version 3.33.4. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/Budibase/budibase |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
8.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/Budibase/budibase |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-25044, GHSA-gjw9-34gf-rp6m
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-kfvy-pknt-qbgv |
|
| 3 |
| url |
VCID-mpmj-pahy-23av |
| vulnerability_id |
VCID-mpmj-pahy-23av |
| summary |
Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authentication is required to trigger the exploit. The process executes as root inside the container. This issue has been patched in version 3.33.4. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://github.com/Budibase/budibase/pull/18238 |
| reference_id |
18238 |
| reference_type |
|
| scores |
| 0 |
| value |
9.0 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
|
| 1 |
| value |
9.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
|
| 2 |
| value |
CRITICAL |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 3 |
| value |
Track* |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-04-03T16:46:19Z/ |
|
|
| url |
https://github.com/Budibase/budibase/pull/18238 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-35216, GHSA-fcm4-4pj2-m5hf
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mpmj-pahy-23av |
|
| 4 |
|
|
| Fixing_vulnerabilities |
|
| Risk_score | 4.5 |
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:npm/%2540budibase/server@2.6.26 |