Budibase’s AI table‑generation feature used a bare server‑side fetch call in the uploadUrl helper, allowing an attacker to instruct the server to fetch an arbitrary URL. The fetched data would then be stored as an attachment without validation, leading to possible exposure of internal services or cloud metadata endpoints. This flaw falls under CWE‑918 and jeopardizes both confidentiality and integrity of data processed by the platform.

The vulnerability exists in Budibase before version 3.39.4. The affected product is the Budibase low‑code platform, and the fix is released in the 3.39.4 update.

The flaw has a CVSS score of 4.9, indicating moderate severity. EPSS is not available, and the issue is not listed in CISA’s KEV catalog. The likely attack vector is by a user who activates AI table generation and supplies an attachment value that references an internal or metadata URL; the server then blindly fetches that URL and stores the response. The exploitation requires the feature to be enabled and may be carried out by any authenticated or untrusted user who can influence the attachment inputs.