[GHSA-6x9p-4r67-5gjx] Budibase authenticated arbitrary S3 signed upload URL issuance via /api/attachments/:datasourceId/url

[kgnio]

Updates

• Affected products

Comments
The structured affected-version range is incorrect and the patched version is missing.

The current advisory lists <= 3.38.1 as affected, but the advisory's own Description documents successful exploitation against Budibase 3.39.7, which is already later than the currently recorded affected range.

The CVE record identifies versions prior to 3.41.3 as affected and identifies 3.41.3 as the fixed version. Budibase 3.41.3 is also an existing published release and is already referenced by this advisory.

This change therefore updates:

Affected versions:
<= 3.38.1 → < 3.41.3

Patched versions:
None → 3.41.3

No changes are made to the title, Description, CWE, CVSS, severity, references, or source code location.

References:

• CVE-2026-54356:
  https://nvd.nist.gov/vuln/detail/CVE-2026-54356

• Budibase 3.41.3 release:
  https://github.com/Budibase/budibase/releases/tag/3.41.3

• Upstream security advisory:
  GHSA-6x9p-4r67-5gjx

[github]

Hi there @mjashanks! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory