Budibase is a low‑code platform that in versions 3.24.0 and earlier suffered an arbitrary file upload flaw. Although administrators can configure file extension restrictions, the enforcement occurs only at the user interface, allowing an attacker to bypass the checks and upload malicious files. This flaw can lead to several high‑severity issues, including stored cross‑site scripting (CWE‑79) and server‑side request forgery (CWE‑918), which can compromise confidentiality, integrity, or availability of the host. The CVSS score of 8.9 reflects the high impact of these consequences.

The affected product is Budibase, specifically all releases 3.24.0 and earlier. Any deployment of these versions hosts the upload endpoint that enforces only client‑side restrictions, making them susceptible to the flaw.

The CVSS score of 8.9 indicates a high severity, while the EPSS score of less than 1 % suggests the likelihood of exploitation in the wild is currently low, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely a web application access, requiring authenticated or unauthenticated users to reach the upload API. Successful exploitation would grant the attacker the ability to deliver malicious files that can lead to file inclusion, SSRF, or XSS, thereby compromising confidentiality, integrity, or availability of the host.