Budibase, an open‑source low‑code platform, stored file uploads without enforcing active‑content restrictions for authenticated users until release 3.38.2. The validation logic for dangerous file extensions was unintentionally wrapped inside conditions that apply only to public users, allowing authenticated builders to upload executable web content such as SVG files containing <script> tags, HTML pages with JavaScript, or .js modules. These files are then stored with the correct MIME types in the object store. When any application user opens the resulting signed URL, the browser executes the embedded script, producing a persistent stored cross‑site scripting vulnerability that affects all users of the application.

Budibase’s low‑code platform is affected when running versions prior to 3.38.2. Users deploying 3.38.1 or earlier are susceptible to the flaw described above. The issue is fixed in the 3.38.2 release.

According to the CVSS score of 7.6, the vulnerability carries a high severity rating. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploitation yet. The likely attack vector requires an authenticated Builder role, which the attacker would use to upload a malicious file to the /api/attachments/process endpoint. Once uploaded, the file is stored and served to any app user, causing the browser to execute the payload. Because the vulnerability persists in the stored data, any future user accessing the same attachment suffers the XSS effect.