Free storage on any bubble app?

AAL · 2024-12-02T16:45:34.116Z

It looks like anyone can upload files to any bubble app using a Post on the /fileupload endpoint.
I’m concerned that this could be some exploit.

Here are a couple of examples. One in bubble.io own instance, and another in an app of mine.

Both successfully returned a file URL and the code is not set to provide any authentication. I get this is to allow anonymous users, for instance, to upload files. But I think that should be only where intended, not for any post request.

image741×270 11.8 KB

image675×185 8.17 KB

tylerboodman · 2024-12-02T18:00:14.569Z

Yes unfortunately they still haven’t patched this

system · 2024-12-16T16:46:08.496Z

This topic was automatically closed after 14 days. New replies are no longer allowed.