Budibase open-source low-code platform prior to version 3.38.2 contains a critical vulnerability in the file upload endpoint POST /api/attachments/process. The vulnerability allows authenticated users to bypass active-content restrictions and upload executable web content including SVG files with inline script tags, HTML pages with JavaScript, and JS modules. These malicious files are stored in the object store (MinIO/S3) with correct MIME types, leading to persistent stored XSS attacks when accessed by application end users. The vulnerability affects all application end users and has been fixed in version 3.38.2.