{"id":"CVE-2026-54356","title":"Budibase is an open-source low-code platform","summary":"Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","cwe":["CWE-862"],"vendor":"budibase","product":"@budibase/server","affected":["@budibase/server <= 3.38.1"],"published":"2026-08-17","updated":"2026-09-08","sourceUpdated":"2026-09-08T21:03:08.410","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54356","references":[{"url":"https://github.com/Budibase/budibase/releases/tag/3.41.3","label":"security-advisories@github.com"},{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-6x9p-4r67-5gjx","label":"security-advisories@github.com"},{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-6x9p-4r67-5gjx","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54356"},{"url":"https://github.com/advisories/GHSA-6x9p-4r67-5gjx"}],"tags":["nvd","exploit-available","ghsa","npm"],"epss":0.00244,"epssPercentile":0.1592,"exploits":{"github":1,"githubRepos":["https://github.com/KovachVL/CVE-2026-54356"],"checkedAt":"2026-09-21T15:29:31.158Z"},"exploitAvailable":true,"aliases":["GHSA-6x9p-4r67-5gjx"],"ecosystem":"npm","ingestedAt":"2026-08-26T14:45:08.545Z","slug":"CVE-2026-54356","body":"## Overview\n\nBudibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled bucket and key values and obtain signedUrl and publicUrl values backed by stored S3 datasource credentials. This issue is fixed in version 3.41.3.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-54356)\n\nAffected packages:\n\n- `@budibase/server <= 3.38.1`\n\nSource: https://github.com/advisories/GHSA-6x9p-4r67-5gjx","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":5339,"id":"CVE-2026-54356","ts":1788887267576,"field":"exploit_available","old":"false","new":"true"},{"seq":4222,"id":"CVE-2026-54356","ts":1788886383247,"field":"exploit_available","old":"true","new":"false"},{"seq":2978,"id":"CVE-2026-54356","ts":1788883047204,"field":"exploit_available","old":"false","new":"true"},{"seq":2007,"id":"CVE-2026-54356","ts":1788882451548,"field":"exploit_available","old":"true","new":"false"},{"seq":1083,"id":"CVE-2026-54356","ts":1788881887947,"field":"exploit_available","old":"false","new":"true"}]}