Budibase is an open-source low-code platform. Prior to 3.34.8, the processUrlFile function in packages/server/src/automations/steps/ai/extract.ts uses fetch(fil…

Budibase, an open-source low-code platform, contains a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 3.34.8. The processUrlFile function in the AI extract automation step bypasses IP blacklist validation, allowing authenticated users to make requests to internal network addresses. This could enable attackers to probe internal systems and potentially access sensitive resources. The vulnerability has been patched in version 3.34.8.