Budibase has 68 CVEs on record. Cadence is steady at roughly 27 per quarter. The busiest recent month was July 2026 with 19. The median CVSS is 8.1 (high), with 11 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-918 (18) and CWE-862 (9). Most affected products: @budibase/server (33), server (24), budibase (10).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.1
- Publish → KEV
- —
- Last 90 days
- 27 prev 36
Weakness classes
Products
- @budibase/server 33
- server 24
- budibase 10
- @budibase/backend-core 2
Worst active — by depth score
CVE-2026-72851Critical· 10.0Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps67CVE-2026-54350Critical· 10.0Budibase has nonymous NoSQL operator injection via published-app query templates67CVE-2026-82244Critical· 9.1Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball62CVE-2026-72850Critical· 9.1Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export62CVE-2026-100682High· 8.8Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation61
Budibase vulnerabilities
CVEs affecting Budibase, newest first. Open any entry for full detail, references, and exploit status.
69 CVEsRSS
CVE-2026-48151High· 7.5Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema
Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema
CVE-2026-48152High· 8.1Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL
Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL
CVE-2026-45061High· 7.7Budibase vulnerable to SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`)
Budibase vulnerable to SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`)
CVE-2026-35216Critical· 9.0Budibase is an open-source low-code platform
Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhoo…
CVE-2026-35214High· 8.7Budibase is an open-source low-code platform
Budibase is an open-source low-code platform. Prior to version 3.33.4, the plugin file upload endpoint (POST /api/plugin/upload) passes the user-supplied filename directly to createTempFolder() without sanitizing path traversal sequences…
CVE-2026-31818Critical· 9.6Budibase is an open-source low-code platform
Budibase is an open-source low-code platform. Prior to version 3.33.4, a server-side request forgery (SSRF) vulnerability exists in Budibase's REST datasource connector. The platform's SSRF protection mechanism (IP blacklist) is rendered…
CVE-2026-25044High· 8.8Budibase is an open-source low-code platform
Budibase is an open-source low-code platform. Prior to version 3.33.4, the bash automation step executes user-provided commands using execSync without proper sanitization or validation. User input is processed through processStringSync w…
CVE-2026-25043Medium· 5.3Budibase is an open-source low-code platform
Budibase is an open-source low-code platform. Prior to version 3.23.25, a business logic vulnerability exists in Budibase’s password reset functionality due to the absence of rate limiting, CAPTCHA, or abuse prevention mechanisms on the …
CVE-2026-33226High· 8.7Budibase is a low code platform for creating internal tools, workflows, and admin panels
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions from 3.30.6 and prior, the REST datasource query preview endpoint (POST /api/queries/preview) makes server-side HTTP requests to any UR…