Security: Budibase/budibase
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query PreviewGHSA-4647-wpjq-hh7f published
Mar 18, 2026 by mjashanksHigh -
Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)GHSA-rvhr-26g4-p2r8 published
Feb 23, 2026 by mjashanksCritical -
Path traversal in plugin file upload enables arbitrary directory deletion and file writeGHSA-2wfh-rcwf-wh23 published
Apr 2, 2026 by mjashanksHigh -
Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS)GHSA-2hfr-343j-863r published
Mar 9, 2026 by mjashanksHigh -
Unauthenticated Password Reset Endpoint Lacks Rate Limiting, Enabling Email FloodingGHSA-277c-prw2-rqgh published
Apr 2, 2026 by mjashanksModerate -
Command Injection in PostgreSQL Dump CommandGHSA-726g-59wr-cj4c published
Mar 9, 2026 by mjashanksCritical -
Command Injection in Bash Automation StepGHSA-gjw9-34gf-rp6m published
Apr 2, 2026 by mjashanksCritical -
Critical Privilege Escalation & IDOR via Missing RBAC on User Role Management (Creator-Role)GHSA-2g39-332f-68p9 published
Mar 9, 2026 by mjashanksCritical -
Privilege Escalation via API Abuse – Creator Can Invite Users with Admin/Any RoleGHSA-4wfw-r86x-qxrm published
Jan 29, 2026 by mjashanksCritical -
VM2 Constructor Escape VulnerabilityGHSA-4g2x-vq5p-5vj6 published
Mar 1, 2024 by shogunpurpleCritical