PT-2026-24106 · Budibase · Budibase

Omkarparth · Published 2026-03-09 · Updated 2026-03-09 · CVE-2026-25041

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.23.22

Description Budibase is a low code platform that allows users to create internal tools, workflows, and admin panels. The PostgreSQL integration within Budibase constructs shell commands using user-controlled configuration values, such as the database name, host, and password, without adequate sanitization. Specifically, the password and other connection parameters are directly interpolated into a shell command within the packages/server/src/integrations/postgres.ts file (lines 529-531). An attacker who can control these database configuration values can inject shell commands. For example, manipulating the password or database name parameters could allow for arbitrary code execution, system compromise, and data exfiltration. The vulnerable code constructs a shell command using template literals, directly embedding the this.config.password value into the PGPASSWORD environment variable.

Recommendations Versions prior to 3.23.22 should be updated. Use environment variables for sensitive values instead of command-line arguments. Validate and sanitize all configuration values. Use proper escaping for shell arguments. Consider using a PostgreSQL library's native dump functionality instead of shell commands. Use execFile with proper argument handling, as shown in the example fix, to avoid shell injection.

Exploit

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2026-25041

GHSA-726G-59WR-CJ4C

Affected Products

Budibase

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25041.json · Exploit
• https://github.com/Budibase/budibase/commit/9fdbff32fb9e69650ba899a799e13f80d9b09e93 · Patch
• https://github.com/Budibase/budibase/security/advisories/GHSA-726g-59wr-cj4c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25041 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25041 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-726g-59wr-cj4c · Vendor Advisory
• https://github.com/Budibase/budibase · Note
• https://github.com/Budibase/budibase/blob/f34d545602a7c94427bae63312a5ee9bf2aa6c85/packages/server/src/integrations/postgres.ts#L529-L531 · Note
• https://twitter.com/CVEnew/status/2031122518933696774 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2031151520310276529 · Twitter Post