CVE-2026-25737
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.24.0 and earlier, an arbitrary file upload vulnerability exists even though file extension restrictions are configured. The restriction is enforced only at the UI level. An attacker can bypass these restrictions and upload malicious files.
- Affected products
- Budibase
- Budibase
- ≤ 3.24.0
- Fix
- Available
- CVSS 3.1
- 9.0 CRITICAL
- EPSS
- 0.3% (18th percentile)
- Weakness
- CWE-602, CWE-918, CWE-79
- NVD status
- Analyzed
- Published
- 2026-03-09
CVE-2026-25737 at NVD
No indexed exploits for CVE-2026-25737 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-25737 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.