Budibase: Unrestricted Upload of File with Dangerous Type
Date: 2026-05
Affected: npm/budibase
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-46426
CWE: CWE-434
CWE-79
CVSS: 7.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N)

### Summary The file upload endpoint `POST /api/attachments/process` does not enforce active-content restrictions for authenticated users. The checks for dangerous file extensions (`html`, `svg`, `js`, `php`, etc.) are conditionally wrapped inside `if (isPublicUser)` or `if (isPublicUser || !env.SELF_HOSTED)`, meaning any authenticated builder can upload executable web content — SVG files with inline `<script>` tags, HTML pages with JavaScript, `.js` modules — which are then stored in the object store (MinIO/S3) with their correct MIME types (`image/svg+xml`, `text/html`, `application/javascript`). When the resulting signed URL is opened by any app user, the browser executes the payload. Impact is **persistent stored XSS** over all application end users. ### Details The vulnerability exists in a single handler function uploadFile shared by two routes, located in packages/server/src/api/controllers/static/index.ts (lines 93–179). Route definitions (packages/server/src/api/routes/static.ts): POST /api/attachments/process → authorized(BUILDER) POST /api/attachments/:tableId/upload → authorized(PermissionType.TABLE, PermissionLevel.WRITE) Both routes invoke the same uploadFile function. The second endpoint is accessible to any authenticated app user (BASIC or POWER role) who has been granted WRITE on any table — not just builders. ### PoC ### Prerequisites - Budibase self-hosted Docker deployment, any version ≤ 3.30.6 - An account with Builder role (does


Mitigations:

Architectural layers (MAESTRO):