Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:LSummary
CVE-2026-25737 is a high-severity Client-Side Enforcement of Server-Side Security (CWE-602) vulnerability in Budibase Budibase. Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 18th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-25 (Reference Monitor) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-25737 is an arbitrary file upload vulnerability in Budibase, an open-source low-code platform for building internal tools, workflows, and admin panels. The issue affects versions 3.24.0 and earlier, where file extension restrictions are enforced only at the user interface level, allowing attackers to bypass these controls and upload malicious files to the server.
The vulnerability has a CVSS v3.1 base score of 8.9 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L), indicating it can be exploited over the network with low complexity by an authenticated user with low privileges, requiring some user interaction. Successful exploitation enables high confidentiality and integrity impacts with a scope change, potentially allowing attackers to upload and execute malicious files, leading to server compromise.
For mitigation details, refer to the official Budibase security advisory at https://github.com/Budibase/budibase/security/advisories/GHSA-2hfr-343j-863r, which covers patches and remediation steps. The vulnerability is associated with CWEs-602 (client-side enforcement of server-side security), CWE-79 (cross-site scripting), and CWE-918 (server-side request forgery).
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10355
Vulnerability Data
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.24.0 and earlier, an arbitrary file upload vulnerability exists even though file extension restrictions are configured. The restriction is enforced only at the UI level.…
more
An attacker can bypass these restrictions and upload malicious files.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V10.7.1V2.2.2V8.3.1V10.4.1
Mitigating Controls (NIST 800-53 r5) AI
Requires a tamper-proof, always-invoked reference monitor that cannot be bypassed by client-side logic.
Enforces all access decisions on the server according to policy rather than trusting client-supplied enforcement.
Enforces information-flow rules at the server boundary instead of delegating them to the client.
Developer testing and evaluation can discover missing or incorrect input neutralization through targeted web-application tests.
Input validation directly enforces neutralization of untrusted data before it reaches web output generation.
Output filtering can catch or sanitize unneutralized script content before it is served to users.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent design flaws that place server security enforcement on the client.
Runtime monitoring of web applications and services can detect anomalous outbound requests indicative of SSRF.
Vulnerability identification processes can discover and record SSRF flaws in web applications.
Proper policy-based enforcement of authorizations implies server-side controls rather than client-only checks.
Network segmentation and egress controls can limit the damage from successful SSRF requests.
Patching and EOL replacement can remediate known XSS instances in libraries or frameworks (partial) but do nothing to enforce input neutralization in application code (none).
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure architecture principles discourage client-side trust but do not directly address this weakness.
Security testing can detect client-side enforcement but is not the primary mitigation.
Information access restriction is undermined when the client is trusted to enforce it.
Knowledge exchange on emerging attack techniques and patches reduces the likelihood that cross-site scripting flaws remain unaddressed in deployed applications.
Operational indicators of compromise for web-application attacks can be incorporated into WAF or input-filtering rules, lowering the likelihood that unsanitized data reaches the browser.
Secure development lifecycle mandates server-side validation and prevents reliance on client enforcement.