CVE-2026-73307

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.39.4

Description The uploadUrl function in packages/server/src/utilities/fileUtils.ts performs a server-side fetch for string attachment values provided by the processAttachments function in packages/server/src/sdk/workspace/ai/helpers/rows.ts without using fetchWithBlacklist validation. A user with access to the AI table-generation feature can manipulate an attachment value to reference internal services or cloud metadata endpoints, allowing the server to fetch and store the response as an attachment.

Recommendations Update to version 3.39.4.