Budibase’s plugin upload endpoint (/api/plugin) accepts any URL that contains the substring ".tar.gz", after which it fetches the URL without further host or path validation. Because the server can be instructed to follow HTTP redirects, an attacker can supply a crafted URL that redirects to an internal address, thereby bypassing the default blacklist of private IP ranges or exploiting an empty blacklist. This flaw constitutes a server‑side request forgery (CWE‑918) that permits the attacker to force the Budibase instance to resolve and access arbitrary internal resources.

Any Budibase deployment running a version earlier than 3.35.10 is affected. The vulnerability resides in the /api/plugin endpoint used for uploading plugin packages, and the impact is independent of custom blacklist configurations.

The CVSS score of 7.7 classifies the vulnerability as high severity. No EPSS value is available, so the current likelihood of exploitation is unknown, and the flaw is not listed in the CISA KEV catalog, indicating no confirmed exploitation events. Nonetheless, a publicly exposed Budibase instance that accepts external plugin URLs offers an attacker a straightforward path to trigger SSRF by sending a URL containing ".tar.gz" and redirecting to an internal target. The combination of high impact and the possibility of bypassing the SSRF blocker results in a considerable risk for affected installations.