CVE-2026-25737: Budibase Arbitrary File Upload Bypassing UI-Only Restrictions

Overview

CVE-2026-25737 is a file upload weakness in Budibase, a low code platform used to build internal tools, workflows and admin panels. According to the record, file extension restrictions exist in the product but are enforced only in the user interface, so the server does not reliably block disallowed files.

Impact

• The record states that an attacker can bypass the UI restrictions and upload malicious files.
• The record maps the weakness to CWE-79 (Cross-site Scripting). The record title also mentions SSRF and stored XSS, but the sources consulted do not describe those effects in detail.
• NVD scores the issue 9.0 (critical) with a CVSS 3.1 vector that includes high confidentiality, integrity and availability impact and a scope change. GitHub scores it 8.9.

Affected products and versions

• Product: Budibase (Budibase).
• Affected: 3.24.0 and earlier.
• No fixed version is listed in the record. This does not mean no fix exists; the fix status is unknown from the sources reviewed.

Exploitation status

• The CISA KEV catalog does not list this CVE, so no confirmed active exploitation is recorded there.
• The SSVC data in the record rates exploitation as proof of concept, and the advisory reference is tagged as exploit-related. No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

• Check whether your Budibase deployment runs version 3.24.0 or earlier and plan an upgrade to a release that includes the vendor fix, following the GitHub advisory.
• Do not rely on UI-side file type checks. Enforce file type, size and content validation on the server.
• Limit who can upload files to internal tools and review existing stored files for unexpected types.
• Serve uploaded files with safe content types and restrictive security headers, and avoid rendering user-supplied files inline in the application origin.

Detection guidance

• Review application and storage logs for uploads of unexpected extensions or MIME types, especially from low-privileged accounts.
• Look for uploaded files that are later requested or rendered in a browser context.
• Monitor outbound requests from the Budibase server for unusual destinations, given the SSRF mention in the record title, while noting that the SSRF details are unverified.

Limitations of the available information

• The record gives no fixed version, no proof-of-concept details beyond the SSVC label, and no technical description of the bypass.
• The SSRF and stored XSS effects named in the title are not described in the description field.
• The EPSS value is low (probability 0.00398), but it is a statistical estimate and does not change the severity of the issue.

Frequently asked questions

Which Budibase versions are affected by CVE-2026-25737?

The record lists Budibase 3.24.0 and earlier as affected. No fixed version is listed in the sources reviewed, so check the GitHub advisory for the current fix status.

Why can attackers bypass the file restrictions?

According to the record, the extension restrictions are enforced only in the user interface and not reliably on the server, which allows disallowed files to be uploaded.

Is this vulnerability known to be exploited in the wild?

The CVE is not listed in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted. The SSVC data rates exploitation as proof of concept.

What should administrators do now?

Confirm whether a deployment runs 3.24.0 or earlier, plan an upgrade following the vendor advisory, enforce file validation on the server, and limit who can upload files.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.