Vulnerability GHSA-6964-pp88-6wp9
Advisory details are being prepared in the background.
Medium Risk
MEDIUM RISK
CVSS Score: 6.0
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
4 months ago
June 12, 2026 at 03:08 PM UTC
Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step
<3.39.0
<3.39.0
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
4 months ago
budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL
<3.39.19 GHSA-qqf5-x7mj-v43p
<3.39.19 GHSA-qqf5-x7mj-v43p
High Risk
5 months ago
Budibase: Unrestricted Upload of File with Dangerous Type
<3.38.2 GHSA-82rc-gxrg-v4gf
<3.38.2 GHSA-82rc-gxrg-v4gf
Medium Risk
5 months ago
Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows
<3.38.1 GHSA-3263-v5v9-xq8q
<3.38.1 GHSA-3263-v5v9-xq8q
High Risk
5 months ago
Budibase vulnerable to SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`)
<3.35.10 GHSA-xh5j-727m-w6gg
<3.35.10 GHSA-xh5j-727m-w6gg
High Risk
7 months ago
Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview
<=3.30.6 GHSA-4647-wpjq-hh7f
<=3.30.6 GHSA-4647-wpjq-hh7f
Impacted packages
Timeline
Published
4 months ago
June 12, 2026 at 03:08 PM UTC
Last Modified
4 months ago
June 12, 2026 at 03:26 PM UTC