CVE-2026-25737 - Vulnerability Analysis

Overview

Budibase <= 3.24.0 contains an unrestricted file upload vulnerability caused by enforcement of file extension restrictions only at the UI level, letting attackers upload malicious files, exploit requires bypassing UI restrictions.

Severity & Score

Impact

Attackers can upload malicious files, potentially leading to remote code execution or system compromise.

Mitigation

Update to a version later than 3.24.0 or the latest available version.

References

• https://github.com/Budibase/budibase/security/advisories/GHSA-2hfr-343j-863r

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 9, 2026

🟠 CVE-2026-25737 - High (8.9) Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.24.0 and earlier, an arbitrary file upload vulnerability exists even though file extension restrictions are configured. The restriction is enforced only... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25737/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner