CVE-2026-48147
published 2026-05-27CVE-2026-48147: Budibase is an open-source low-code platform. Prior to 3.35.4, the buildMatcherRegex() / matches() functions in…
PriorityP337medium6.5CVSS 3.1
AVNACLPRNUIRSUCNIHAN
EPSS
0.11%
1.8th percentile
Budibase is an open-source low-code platform. Prior to 3.35.4, the buildMatcherRegex() / matches() functions in packages/backend-core/src/middleware/matchers.ts route patterns are compiled into unanchored regular expressions and tested against ctx.request.url, which includes the full query string. The CSRF middleware in the Budibase Worker uses this matching system to decide whether to skip CSRF token validation. An unauthenticated attacker can forge state-changing cross-origin requests against any Worker API endpoint by injecting a public route pattern into the query string, causing the CSRF middleware to skip token validation entirely. This allows actions such as sending admin invites, modifying global configuration, and managing users without a valid CSRF token. This vulnerability is fixed in 3.35.4.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| budibase | backend-core | >= 0 < 3.35.4 | 3.35.4 |
| budibase | budibase | < 3.35.4 | 3.35.4 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
ghsa9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker
ghsa·2026-06-12·CVSS 9.1
CVE-2026-48147 [CRITICAL] CWE-185 Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker
Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker
### Summary
The `buildMatcherRegex()` / `matches()` functions in `packages/backend-core/src/middleware/matchers.ts` share the same structural root cause as the recently patched CVE-2026-31816: route patterns are compiled into **unanchored regular expressions** and tested against `ctx.request.url`, which includes the full query string. The CSRF middleware in the Budibase Worker uses this matching system to decide whether to skip CSRF token validation. An unauthenticated attacker can forge state-changing cross-origin requests against any Worker API endpoint by injecting a public route pattern into the query string, causing the CSRF middleware to skip token validation entirely. This
VulDB
budibase up to 3.35.3 Worker API Endpoint buildMatcherRegex incorrect regex (GHSA-wxq7-x3qp-vcr8)
vuldb·2026-05-27·CVSS 6.5
CVE-2026-48147 [MEDIUM] budibase up to 3.35.3 Worker API Endpoint buildMatcherRegex incorrect regex (GHSA-wxq7-x3qp-vcr8)
A vulnerability described as problematic has been identified in budibase up to 3.35.3. This vulnerability affects the function buildMatcherRegex of the component Worker API Endpoint. Executing a manipulation can lead to incorrect regular expression.
This vulnerability is registered as CVE-2026-48147. It is possible to launch the attack remotely. No exploit is available.
Upgrading the affected component is recommended.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-27
Published