8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25041

CVE-2026-25041: Budibase has a Command Injection in PostgreSQL Dump Command

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.23.22 and earlier, the PostgreSQL integration constructs shell commands using user-controlled configuration values (database name, host, password, etc.) without proper sanitization. The password and other connection parameters are directly interpolated into a shell command. This affects packages/server/src/integrations/postgres.ts.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25041

CVE-2026-25041:

8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@budibase/server	npm	< 3.23.32	3.23.32

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a command injection flaw within the PostgreSQL integration of the Budibase server. The root cause is the improper construction of a shell command to execute pg_dump for schema exporting. User-controlled data, such as the database password, host, and database name, are directly concatenated into the command string. An attacker with the ability to modify these datasource configuration values can inject arbitrary shell commands, leading to remote code execution on the server.

The provided patch 9fdbff32fb9e69650ba899a799e13f80d9b09e93 addresses the vulnerability by completely removing the schema export functionality. The analysis of this patch identified two key functions in the execution path of the vulnerability:

PostgresIntegration.getExternalSchema in packages/server/src/integrations/postgres.ts: This is the function where the vulnerable pg_dump command is constructed and executed via child_process.exec.
getExternalSchema in packages/server/src/api/controllers/datasource.ts: This is the API controller that handles requests to the /api/datasources/:datasourceId/schema/external endpoint. It retrieves the datasource configuration and invokes the vulnerable getExternalSchema method on the connector.

During an exploit, both of these functions would likely appear in a runtime profile or stack trace, making them critical indicators for detecting attempts to trigger this vulnerability.

Vulnerable functions

PostgresIntegration.getExternalSchema

packages/server/src/integrations/postgres.ts

This function constructs and executes a shell command for `pg_dump`. It directly includes the user-provided database password and other connection details in the command string without proper sanitization, leading to a command injection vulnerability.

getExternalSchema

packages/server/src/api/controllers/datasource.ts

This API controller function is the entry point for the vulnerability. It retrieves the datasource, which includes user-controlled configuration, and calls the vulnerable `connector.getExternalSchema()` method, which for a PostgreSQL datasource is `PostgresIntegration.getExternalSchema`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.