CVE-2026-104476
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compressed archives generated by users with configuration export permission to obtain the full site configuration, including sensitive settings.
Risk Assessment
An unauthenticated attacker can access the full site configuration, including sensitive settings, which may facilitate further attacks. This could lead to a compromise of the entire system.
Recommendation
Update Backdrop CMS to version 1.35.1 or later. Remove any leftover configuration export archives from the server.
Other vulnerabilities in Backdrop CMS
See all- CVE-2025-71310Low
The GDPR cookies module for Backdrop CMS before version 1.x-1.3.5 does not sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has been provided for the optional 'Info content' field for the YouTube service. The attack is mitigated by the fact that an attacker must have a role with permission to create or edit GDPR Cookies services and the site must have a YouTube service configured.
- CVE-2025-44141Medium
A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30. It allows injection of malicious JavaScript code into the page.
- CVE-2022-34530Medium
An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames.
Original NVD description (English source)
Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compressed archives generated by users with configuration export permission to obtain the full site configuration, including sensitive settings.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS