CVE-2026-25737

Katalog CVE

CVSS 9.0 · Critical EPSS 0,40%

Kerentanan Client-Side Enforcement of Server-Side Security pada budibase. Skor CVSS 3.1 9.0 (Critical) menurut NVD.

Deskripsi (NVD)

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.24.0 and earlier, an arbitrary file upload vulnerability exists even though file extension restrictions are configured. The restriction is enforced only at the UI level. An attacker can bypass these restrictions and upload malicious files.

Rincian

Terbit di NVD

9 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-602: Client-Side Enforcement of Server-Side Security
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Budibase/budibase/security/advisories/GHSA-2hfr-343j-863r exploit · advisory vendor