CVE-2026-25041 Budibase has a Command Injection in PostgreSQL Dump Command
Attackers can execute arbitrary commands via unsanitized PostgreSQL connection parameters in Budibase, requiring an upgrade to secure the platform.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25041?
CVE-2026-25041 is a high-severity command injection vulnerability in budibase, published on 9 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.23.22 and earlier, the PostgreSQL integration constructs shell commands using user-controlled configuration values (database name, host, password, etc.) without proper sanitization. The password and other connection parameters are directly interpolated into a shell command. This affects packages/server/src/integrations/postgres.ts.
Weakness: CWE-78
Which versions are affected by CVE-2026-25041?
2 open source packages ship an affected version, including @budibase/server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@budibase/server npm | All versions | 3.23.32 |
@budibase/server npm | All versions | 3.23.32 |
Products include Budibase Budibase.
How do I fix CVE-2026-25041?
Upgrade @budibase/server to 3.23.32 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-25041 being exploited?
There is no known exploitation of CVE-2026-25041 in the wild and no public exploit code.
Other vulnerabilities in budibase
- CVE-2026-54350 Budibase: Anonymous NoSQL operator injection via published-app query templates
- CVE-2026-27702 Budibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)
- CVE-2026-54352 Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload
- CVE-2026-31818 Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
- CVE-2026-30240 Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets
Sources
Also known as GHSA-726g-59wr-cj4c.