Budibase, an open‑source low‑code platform, has a flaw that allows anyone to obtain a signed S3 PutObject URL without any authentication. The vulnerable endpoint accepts a workspace ID and a datasource ID, both of which are public, and generates the presigned URL using credentials stored in the workspace. An attacker can specify arbitrary bucket and key values, enabling the upload of any file to any S3 bucket the credentials grant access to, thereby compromising data integrity and potentially creating a persistence layer.

This issue affects all Budibase installations running a version older than 3.39.3. The vulnerability exists on the application server endpoint that does not enforce authentication, table permissions, datasource permissions, or builder access. If an attacker knows the workspace and datasource identifiers, they can target any deployment exposed to the internet.

The CVSS score of 7.4 indicates a medium‑to‑high severity. While the EPSS score is not available, the lack of authentication and the availability of the public endpoint make exploitation straightforward for those who identify the target workspace and datasource. The vulnerability is not yet listed in the CISA KEV catalog, but any exposed deployment should consider the risk as significant and act promptly.