CVE-2026-46426: Budibase File Upload XSS Vulnerability

CVE-2026-46426 Overview

CVE-2026-46426 is a stored cross-site scripting (XSS) vulnerability in Budibase, an open-source low-code application platform. The POST /api/attachments/process endpoint skips active-content checks for authenticated users, allowing any builder to upload executable web content. Files such as SVGs containing inline <script> tags, HTML pages with JavaScript, and .js modules are written to the configured object store (MinIO or S3) with their original MIME types. When an application end user opens the resulting signed URL, the browser executes the attacker payload. The flaw is tracked as [CWE-79] and is fixed in Budibase 3.38.2.

Critical Impact
An authenticated builder can plant persistent XSS payloads that execute in every application user's browser session.

Affected Products

Budibase versions prior to 3.38.2
Self-hosted Budibase deployments using MinIO or S3 object storage
Budibase Cloud builder accounts serving end users

Discovery Timeline

2026-05-27 - CVE-2026-46426 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46426

Vulnerability Analysis

The attachment processor in Budibase validates dangerous file extensions only when specific conditions apply. The relevant guards are written as if (isPublicUser) or if (isPublicUser || !env.SELF_HOSTED), which means the dangerous-extension blocklist is bypassed for any authenticated builder on a self-hosted instance. The endpoint accepts the file, persists it to the configured object store, and preserves the client-supplied MIME type. Because the response returns a signed URL pointing directly at the object, the browser later renders the content according to that MIME type rather than treating it as an inert download.

Root Cause

The root cause is incorrect access-control logic in the upload handler. Active-content validation is gated by user role and deployment mode instead of being enforced for every upload. The check assumes authenticated builders are trusted to upload arbitrary content, which conflicts with the security model when those uploads are then served to lower-privileged application users. The vulnerability falls under improper neutralization of input during web page generation [CWE-79].

Attack Vector

An attacker with a builder account uploads an SVG, HTML, or JavaScript file containing a payload to /api/attachments/process. The object is stored with a renderable MIME type such as image/svg+xml or text/html. The attacker then references the signed URL from inside a published application, embeds it as an image source, or shares it directly. Any application user who loads the URL executes the script in the context of the Budibase origin, enabling session theft, account takeover within the app boundary, and pivoting to internal data exposed through the application.

No verified proof-of-concept code is published. See the GitHub Security Advisory GHSA-82rc-gxrg-v4gf for the vendor write-up.

Detection Methods for CVE-2026-46426

Indicators of Compromise

Objects in the Budibase MinIO or S3 bucket with extensions such as .svg, .html, .htm, .js, .mjs, or .xhtml uploaded after a builder account was provisioned
Stored attachments whose Content-Type is image/svg+xml, text/html, or application/javascript
Unexpected outbound requests from end-user browsers to attacker-controlled domains after loading an application page that references an attachment URL

Detection Strategies

Inspect the attachments bucket for files whose binary contents include <script, onload=, onerror=, or javascript: URIs.
Review web server and object store access logs for POST /api/attachments/process requests followed by GET requests to the resulting signed URLs from unrelated user sessions.
Audit builder account creation and role changes that preceded suspicious uploads.

Monitoring Recommendations

Alert on uploads from authenticated Budibase sessions where the stored MIME type is renderable as active content.
Monitor browser content security policy (CSP) violation reports originating from Budibase application origins.
Track first-seen file hashes in the attachments bucket and flag any HTML or SVG content for review.

How to Mitigate CVE-2026-46426

Immediate Actions Required

Upgrade all Budibase instances to version 3.38.2 or later without delay.
Rotate builder account credentials and review recent builder activity for unexpected uploads.
Delete or quarantine any attachment objects identified as active content during triage.

Patch Information

The issue is fixed in Budibase 3.38.2. The release removes the conditional wrappers around dangerous-extension checks so that active-content validation runs for all users regardless of role or deployment mode. Release notes are available in the GitHub Release 3.38.2 and the GitHub Security Advisory GHSA-82rc-gxrg-v4gf.

Workarounds

Restrict creation of builder accounts to trusted administrators until the upgrade is applied.
Place a reverse proxy in front of the object store that forces Content-Disposition: attachment and overrides MIME types for .svg, .html, and .js objects.
Apply a strict Content Security Policy on the Budibase application origin to block inline script execution from attachment URLs.

bash

# Example NGINX override forcing safe handling of attachment responses
location /files/signed/ {
    proxy_pass http://minio-upstream;
    proxy_hide_header Content-Type;
    add_header Content-Type "application/octet-stream" always;
    add_header Content-Disposition "attachment" always;
    add_header X-Content-Type-Options "nosniff" always;
}