EUVD-2026-58526Severity by source
AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
AV:N because Budibase is a web-accessible platform; PR:H because exploiting requires DDL privileges on the target MySQL database; UI:R because an admin must trigger schema discovery; S:C because injected SQL executes against the underlying database beyond Budibase's own scope.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait for a Budibase administrator to run schema discovery, causing the second statement to execute. The fix applies quoteMySqlIdentifier before constructing the query. This issue is fixed in version 3.39.18.
AnalysisAI
SQL injection via MySQL backtick escape failure in Budibase's schema discovery feature allows an attacker with MySQL table-creation privileges to achieve arbitrary SQL execution on the underlying database. Affected versions prior to 3.39.18 interpolate raw table names into DESCRIBE queries while the MySQL connection has multipleStatements enabled, meaning a maliciously named table breaks out of the backtick-quoted identifier and executes attacker-controlled SQL when a Budibase administrator next triggers schema introspection. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two independent prerequisites that must both be satisfied. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) scores 7.6, which accurately reflects a vulnerability with high prerequisites but severe impact when those prerequisites are met. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with write access to the MySQL database backing a Budibase instance - for example, a lower-privileged application user in a shared database environment - creates a table named foo`; DROP TABLE sensitive_data; -- with a backtick and stacked DROP statement embedded in the name. The attacker then waits; when a Budibase administrator next opens the datasource settings or refreshes the schema, Budibase reads the malicious table name from INFORMATION_SCHEMA.TABLES and injects it unescaped into DESCRIBE `foo`; DROP TABLE sensitive_data; --, causing the MySQL driver (with multipleStatements enabled) to execute the DROP statement as a second query. … |
| Remediation | The primary fix is upgrading @budibase/server to version 3.39.18 or later, available at https://github.com/Budibase/budibase/releases/tag/3.39.18; the upstream patch commit is d232bd92144c768884ff8c48cb2e28673d9ffde0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Budibase instances and verify versions against 3.39.18; disable or restrict schema discovery feature access to trusted administrators only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today