{"id":"CVE-2026-103757","published":"2026-10-01T11:17:26.177","lastModified":"2026-10-01T14:17:28.720","description":"Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packages/server/src/utilities/fileUtils.ts uses raw node-fetch instead of fetchWithBlacklist. Authenticated builder users can send a prompt to POST /api/ai/tables that places an internal URL in an attachment column, causing the server to fetch it and return a presigned object-storage URL containing the response, such as cloud metadata credentials.","cvssScore":7.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-3c52-v5v2-3r56","tags":[]},{"url":"https://www.vulncheck.com/advisories/budibase-before-3.41.0-ssrf-via-uploadurl-in-ai-table-generation","tags":[]},{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-3c52-v5v2-3r56","tags":[]}],"exploitRefs":[{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-3c52-v5v2-3r56","tags":[]},{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-3c52-v5v2-3r56","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows authenticated users to exploit a server-side request forgery vulnerability to fetch internal URLs, potentially leading to credential exposure.","exploitability":"Exploitation requires an authenticated builder user and knowledge of internal URLs. The vulnerability is relatively easy to exploit given the preconditions.","blast_radius":"If exploited, the vulnerability could lead to unauthorized access to internal resources and potential credential theft.","remediation":"Upgrade to Budibase 3.42.0 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["srf","auth","web","fetch"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-09T08:45:13.896Z"}}