PT-2026-41394 · Npm+2 · @Budibase/Server+1

Morimori-Dev · Published 2026-05-15 · Updated 2026-05-27 · CVE-2026-45548

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.34.8

Description An authenticated user can trigger server-side requests to internal network addresses. This occurs because the processUrlFile() function in packages/server/src/automations/steps/ai/extract.ts uses fetch(fileUrl) directly, bypassing the IP blacklist validation applied to other automation steps. This allows access to cloud metadata endpoints, internal network scanning, and access to internal APIs. The fileUrl variable is the vulnerable parameter used to initiate these requests.

Recommendations Update to version 3.34.8. As a temporary workaround, restrict the use of the AI Extract File step with the source set to URL until the update is applied.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-45548

GHSA-RPJ4-7X2V-WJRF

Affected Products

@Budibase/Server

Budibase

References · 8

• 🔥 https://github.com/Budibase/budibase/security/advisories/GHSA-rpj4-7x2v-wjrf · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45548.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45548 · Security Note
• https://osv.dev/vulnerability/CVE-2026-45548 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rpj4-7x2v-wjrf · Vendor Advisory
• https://github.com/Budibase/budibase/releases/tag/3.38.4 · Note
• https://github.com/Budibase/budibase · Note
• https://twitter.com/CVEnew/status/2059718128108741028 · Twitter Post