CVE-2026-25737: File Upload Restriction Bypass in Budibase

CVE-2026-25737 is an arbitrary file upload flaw in Budibase 3.24.0 and earlier, rated 8.9. The file extension restriction an administrator configures is enforced only in the user interface, so a request made directly can upload disallowed files. Check the advisory for the fixed release.

What's affected

• Product: Budibase, the low code platform for internal tools.
• Affected: 3.24.0 and earlier.
• Fixed version: the record does not state one. Check the GitHub advisory and the Budibase releases page for the first patched version.
• Exposure: any app that accepts file uploads and relies on extension limits.

How to check if you're exposed

Find your Budibase version in the admin settings, or from the container image tag you deployed:

docker ps --format '{{.Image}}' | grep -i budibase

Then list apps with upload fields and inspect your object storage for file types that the restriction should have blocked, such as html or svg.

What to do now

1. Read the advisory and upgrade to the first fixed release when you can confirm it.
2. Review uploaded files in your storage bucket for unexpected types.
3. Serve user uploads from a separate domain with a download disposition, so stored content cannot run in your app's origin.
4. Add an upstream proxy or storage policy that checks content type, since UI settings cannot be trusted.
5. Limit who can upload to the apps that need it.

Why it matters

The record lists CWE-602, client side enforcement of server side security, along with CWE-79 and CWE-918. The core mistake is trusting the browser to apply a rule. Anyone can send the request without the browser.

Uploaded HTML or script content on the same origin as the platform can lead to cross site scripting and takeover of other users' sessions. Check the advisory for which of those outcomes the project confirmed. The record does not mark this CVE as exploited in the wild.

Quick check

Sources

• GitHub advisory GHSA-2hfr-343j-863r

Last reviewed: 19 October 2026.