CVE-2026-54356

Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled...

CVE-2026-54356 Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`

Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled...

CVE-2026-54356

creationtimestamp| type| source ---|---|--- 2026-08-15 08:00:04+00:00| seen| Telegram/FN3zo1JYTO4u1-YgV96W0gS9NsAaW44hUrWdmlv8YAKw1wA 2026-08-16 00:00:46+00:00| published-proof-of-concept| Telegram/FN3zo1JYTO4u1-YgV96W0gS9NsAaW44hUrWdmlv8YAKw1wA 2026-08-27 09:34:14+00:00| seen|...