Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation

Description

CWE-918: Server-Side Request Forgery (SSRF)

The processUrlFile function in packages/server/src/automations/steps/ai/extract.ts uses fetch(fileUrl) directly without the IP blacklist validation that is consistently applied to all other automation steps.

Recommendation

Update the @budibase/server package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.34.8
• Patched version(s): 3.34.8

References

• GHSA-rpj4-7x2v-wjrf
• CVE-2026-45548
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step - CVE-2026-35216
• Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration - CVE-2026-45715
• Budibase: Command Injection in Bash Automation Step - CVE-2026-25044
• Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API - CVE-2026-45719

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

@budibase/server