CVE-2026-73408
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Budibase prior to 3.39.18 contains a SQL injection vulnerability in the MySQL integration where the table name is not properly escaped in a DESCRIBE statement. An attacker can create a table with a name containing a backtick and stacked statement, which executes during schema discovery by an administrator. Fixed in version 3.39.18.
Risk Assessment
The risk is that an attacker can execute unauthorized SQL queries on the MySQL database, potentially compromising data confidentiality and integrity.
Recommendation
Immediately upgrade Budibase to version 3.39.18 or later to remediate the vulnerability.
Original NVD description (English source)
Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait for a Budibase administrator to run schema discovery, causing the second statement to execute. The fix applies quoteMySqlIdentifier before constructing the query. This issue is fixed in version 3.39.18.