CVE-2026-54356 — Budibase: authenticated arbitrary S3 signed upload URL issuance

A low-privilege (BASIC role) authenticated user of a published Budibase workspace can call POST /api/attachments/:datasourceId/url and obtain an S3 pre-signed upload URL signed with the workspace datasource's server-side AWS credentials, for an attacker-controlled object key (and, if the datasource has no fixed bucket, an attacker-controlled bucket too).

Root cause

packages/server/src/api/routes/static.ts:

.post(
  "/api/attachments/:datasourceId/url",
  recaptcha,
  authorized(PermissionType.TABLE, PermissionLevel.WRITE), // too low, wrong resource
  controller.getSignedUploadURL
)

packages/server/src/api/controllers/static/index.ts (getSignedUploadURL) loads the datasource by :datasourceId, pulls its stored accessKeyId/secretAccessKey, and signs a PutObject request for the attacker-supplied bucket/key:

const { bucket, key } = ctx.request.body || {}
const s3 = new S3({
  credentials: {
    accessKeyId: datasource?.config?.accessKeyId as string,
    secretAccessKey: datasource?.config?.secretAccessKey as string,
  },
})
signedUrl = await getSignedUrl(s3, new PutObjectCommand({ Bucket: bucket, Key: key }))

Minting a credential-backed signed URL is a privileged action, but the check only requires generic table-write permission (which BASIC holds) and never verifies the caller is entitled to use that specific datasource. Expected: 403. Actual: 200 with signedUrl/publicUrl.

Impact

• Attacker gets valid PutObject pre-signed URLs signed with the org's stored AWS credentials.
• Can write/overwrite arbitrary object keys in the datasource bucket, and — when no bucket is pinned in the datasource config — potentially any bucket those credentials can reach.
• The signed URL works off-platform (plain curl/PUT).

PoC

See poc/:

• poc/exploit.sh — curl PoC (login → mint signed URL → upload proof file).
• poc/poc.py — same flow in Python.

python3 poc/poc.py \
  --target http://localhost:10000 \
  --app-id app_xxx --datasource-id datasource_xxx \
  --email [email protected] --password 'Password123!' \
  --bucket my-attachments --key poc/cve-2026-54356/proof.txt \
  --upload

Remediation

Upgrade to Budibase 3.41.3+. If you can't upgrade immediately, scope the S3 datasource's AWS credentials to least-privilege (bucket/prefix-restricted IAM policy) and monitor for unexpected PutObject activity.

Credit

Discovered and reported by @KovachVL.

Disclaimer

For educational/defensive use and coordinated disclosure only. Only test systems you own or are explicitly authorized to test.