{"id":"CVE-2026-54356","aliases":["EUVD-2026-60382","GHSA-6x9p-4r67-5gjx"],"status":"published","title":"Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`","description":"Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled bucket and key values and obtain signedUrl and publicUrl values backed by stored S3 datasource credentials. This issue is fixed in version 3.41.3.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00352,"percentile":0.29214,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-862"],"published":"2026-08-17T20:32:05Z","modified":"2026-10-28T02:30:58Z","exploits":[{"source":"pocgithub","id":"KovachVL/CVE-2026-54356","title":"KovachVL/CVE-2026-54356","date":"2026-08-14","url":"https://github.com/KovachVL/CVE-2026-54356"}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@budibase/server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.38.1"}]}]},{"source":"osv","ecosystem":"npm","package":"@budibase/server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"3.38.1"}]}]}],"products":[{"vendor":"budibase","product":"budibase"}],"references":[{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-6x9p-4r67-5gjx","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/Budibase/budibase/releases/tag/3.41.3","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54356","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6x9p-4r67-5gjx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54356.json","tags":["advisory"]},{"url":"https://github.com/Budibase/budibase","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-54356","title":"Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`","description":"Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled bucket and key values and obtain signedUrl and publicUrl values backed by stored S3 datasource credentials. This issue is fixed in version 3.41.3.","status":"published","published":"2026-08-17T20:32:05.691Z","modified":"2026-08-18T13:33:04.062Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T13:38:09.774038Z"}],"euvd":[{"id":"EUVD-2026-60382","description":"Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled bucket and key values and obtain signedUrl and publicUrl values backed by stored S3 datasource credentials. This issue is fixed in version 3.41.3.","status":"published","published":"2026-08-17T20:32:05Z","modified":"2026-08-18T13:33:04Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T18:01:47.222335Z"}],"ghsa":[{"id":"GHSA-6x9p-4r67-5gjx","title":"Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`","description":"### Summary\nBudibase 3.39.7 allows a low-privilege authenticated published-app user with the built-in BASIC role to obtain arbitrary S3 pre-signed upload URLs backed by a workspace datasource's stored server-side credentials.\n\nThe affected endpoint is:\n\n`POST /api/attachments/:datasourceId/url`\n\nThe caller can control:\n```text\nbucket\nkey\n```\nand receives:\n```text\nsignedUrl\npublicUrl\n```\n\nThis lets a low-privilege published-app user mint S3 `PUT` URLs using server-side datasource credentials for attacker-chosen object destinations.\n\nSteps:\n\n1. Log in as an admin user.\n2. Create a new app/workspace.\n3. In the development app context, create an S3 datasource with valid credentials.\n4. Publish the app.\n5. Create a low-privilege user with the built-in BASIC role on the published production app ID.\n6. Log in as that BASIC user.\n7. Send:\n`POST /api/attachments/\u003cdatasourceId\u003e/url`\n\nwith:\n```json\n{\"bucket\":\"foo\",\"key\":\"bar\"}\n```\nand the published app header:\n```text\nx-budibase-app-id: \u003cpublished_app_id\u003e\n```\nObserve a successful response containing:\n```text\nsignedUrl\npublicUrl\n```\n\n### Observed result\n\nThe following behavior:\n\ndev BASIC request: 403 User does not have permission\napp publish: SUCCESS\nprod BASIC request: 200 OK\nExample confirmed runtime values from the final successful run:\n```text\nprodAppId: app_e6b4cdc6cd6949969a83ff11eee88c5a\ndatasourceId: datasource_0cec491b26a742468257c62382aa3284\npublicUrl: https://foo.s3.eu-west-1.amazonaws.com/bar\n```\nThe returned signedUrl contained standard AWS signing markers, including:\n```text\nX-Amz-Credential=bb\nX-Amz-Signature\nX-Amz-Expires=900\n```\n### Impact\n\nA low-privilege published-app user who knows a valid datasource ID can mint S3 upload URLs backed by server-side datasource credentials and choose arbitrary destination bucket and key values.\n\n### Route definition\n`packages/server/src/api/routes/static.ts:45`\nAuthorization logic\n`packages/server/src/middleware/authorized.ts`\n`packages/server/src/middleware/resourceId.ts`\nController logic\n`packages/server/src/api/controllers/static/index.ts`\nDatasource lookup\n`packages/server/src/sdk/workspace/datasources/datasources.ts`","status":"published","published":"2026-08-26T14:07:26Z","modified":"2026-08-26T14:07:28Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:41:05.994358Z"}],"nvd":[{"id":"CVE-2026-54356","description":"Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled bucket and key values and obtain signedUrl and publicUrl values backed by stored S3 datasource credentials. This issue is fixed in version 3.41.3.","status":"published","published":"2026-08-17T21:16:46.063Z","modified":"2026-09-08T21:03:08.41Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:38.647684Z"}],"osv":[{"id":"CVE-2026-54356","title":"Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`","description":"Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled bucket and key values and obtain signedUrl and publicUrl values backed by stored S3 datasource credentials. This issue is fixed in version 3.41.3.","status":"published","published":"2026-08-17T20:32:05.691Z","modified":"2026-10-28T02:30:58.718637318Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:45:10.818486Z"},{"id":"GHSA-6x9p-4r67-5gjx","title":"Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`","description":"### Summary\nBudibase 3.39.7 allows a low-privilege authenticated published-app user with the built-in BASIC role to obtain arbitrary S3 pre-signed upload URLs backed by a workspace datasource's stored server-side credentials.\n\nThe affected endpoint is:\n\n`POST /api/attachments/:datasourceId/url`\n\nThe caller can control:\n```text\nbucket\nkey\n```\nand receives:\n```text\nsignedUrl\npublicUrl\n```\n\nThis lets a low-privilege published-app user mint S3 `PUT` URLs using server-side datasource credentials for attacker-chosen object destinations.\n\nSteps:\n\n1. Log in as an admin user.\n2. Create a new app/workspace.\n3. In the development app context, create an S3 datasource with valid credentials.\n4. Publish the app.\n5. Create a low-privilege user with the built-in BASIC role on the published production app ID.\n6. Log in as that BASIC user.\n7. Send:\n`POST /api/attachments/\u003cdatasourceId\u003e/url`\n\nwith:\n```json\n{\"bucket\":\"foo\",\"key\":\"bar\"}\n```\nand the published app header:\n```text\nx-budibase-app-id: \u003cpublished_app_id\u003e\n```\nObserve a successful response containing:\n```text\nsignedUrl\npublicUrl\n```\n\n### Observed result\n\nThe following behavior:\n\ndev BASIC request: 403 User does not have permission\napp publish: SUCCESS\nprod BASIC request: 200 OK\nExample confirmed runtime values from the final successful run:\n```text\nprodAppId: app_e6b4cdc6cd6949969a83ff11eee88c5a\ndatasourceId: datasource_0cec491b26a742468257c62382aa3284\npublicUrl: https://foo.s3.eu-west-1.amazonaws.com/bar\n```\nThe returned signedUrl contained standard AWS signing markers, including:\n```text\nX-Amz-Credential=bb\nX-Amz-Signature\nX-Amz-Expires=900\n```\n### Impact\n\nA low-privilege published-app user who knows a valid datasource ID can mint S3 upload URLs backed by server-side datasource credentials and choose arbitrary destination bucket and key values.\n\n### Route definition\n`packages/server/src/api/routes/static.ts:45`\nAuthorization logic\n`packages/server/src/middleware/authorized.ts`\n`packages/server/src/middleware/resourceId.ts`\nController logic\n`packages/server/src/api/controllers/static/index.ts`\nDatasource lookup\n`packages/server/src/sdk/workspace/datasources/datasources.ts`","status":"published","published":"2026-08-26T14:07:26Z","modified":"2026-08-26T14:15:08.19488176Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:46:40.308826Z"}]}}