Description

Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled bucket and key values and obtain signedUrl and publicUrl values backed by stored S3 datasource credentials. This issue is fixed in version 3.41.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-17T21:16:46.063Z",
  "pubdate": "2026-08-17T21:16:46.063Z",
  "executiveSummary": "An authorization and input validation vulnerability exists within the Budibase low-code platform prior to version 3.41.3.\nThe flaw allows an authenticated published-app user possessing the BASIC role to supply arbitrary attacker-controlled bucket and key parameters.\nBy interacting with the affected API endpoint, low-privileged users can obtain signedUrl and publicUrl values that are cryptographically backed by stored S3 datasource credentials.\nThis unauthorized exposure of storage resource locators and underlying S3 storage integration parameters significantly impacts confidentiality.\nThe risk implication involves potential unauthorized access to sensitive cloud storage assets and internal data structures tied to the S3 datasource.\nExploitation requires network access to the API, authenticated access with at least the BASIC role within a published application, and the ability to submit customized bucket and key values to the target route.",
  "technicalDetails": "The vulnerability resides in the static file attachment handling subsystem of Budibase, specifically within the POST /api/attachments/:datasourceId/url endpoint located in packages/server/src/api/routes/static.ts and handled by the controller logic in packages/server/src/api/controllers/static/index.ts.\nThe root cause stems from insufficient validation and authorization checks regarding user-supplied parameters passed to backend S3 integration functions.\nSpecifically, an authenticated user assigned the BASIC role within a published application can interact with the attachment URL generation route and supply arbitrary, attacker-controlled bucket and key values.\nUpon receiving these crafted parameters, the application processes them utilizing stored S3 datasource credentials to generate and return signedUrl and publicUrl values without adequately verifying whether the requesting user possesses administrative or data-owner privileges over the specified storage location.\nThe attack flow proceeds as follows: 1) The malicious actor authenticates to a published Budibase application with a BASIC role account. 2) The actor crafts an HTTP POST request targeting /api/attachments/:datasourceId/url. 3) The request body injects manipulated bucket and key strings. 4) The server-side controller processes the request using the configured S3 datasource credentials. 5) The server returns the generated presigned and public URLs to the client. 6) The attacker leverages the returned URLs to access or interact with restricted cloud storage objects.\nThe vulnerable component is the static attachment routing and controller logic responsible for resolving datasource attachments. Affected versions comprise all Budibase installations prior to version 3.41.3. Network exposure is inherent to any deployment exposing the Budibase API and published applications. Privilege requirements are limited to authenticated access with the BASIC role, lowering the barrier to exploitation by internal users or compromised low-privileged accounts."
}