Budibase is an open-source low-code platform. Prior to 3.34.8, the processUrlFile function in packages/server/src/automations/steps/ai/extract.ts uses fetch(fil…

Published:

26 mei 2026 om 22:00:00

Alert date:

27 mei 2026 om 19:08:13

Source:

nvd.nist.gov

Web Technologies, Enterprise Applications

Budibase open-source low-code platform contains a server-side request forgery (SSRF) vulnerability in versions prior to 3.34.8. The vulnerability exists in the processUrlFile function which lacks IP blacklist validation, allowing authenticated users to trigger requests to internal network addresses. The flaw is in the automation steps AI extract functionality and has been fixed in version 3.34.8.

Technical details

Mitigation steps:

Affected products:

Budibase