CVE-2026-54356: Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-17 · updated 2026-09-08
Weakness: CWE-862

Description

Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled bucket and key values and obtain signedUrl and publicUrl values backed by stored S3 datasource credentials. This issue is fixed in version 3.41.3.

Affected products

budibase: before 3.41.3

References

https://github.com/Budibase/budibase/releases/tag/3.41.3
https://github.com/Budibase/budibase/security/advisories/GHSA-6x9p-4r67-5gjx
https://github.com/Budibase/budibase/security/advisories/GHSA-6x9p-4r67-5gjx

Get alerted when CVE-2026-54356 or the next vulnerability affects your stack