CVE-2026-107914
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested by someone with the "Synchronize, import, and export configuration" permission. NOTE: CVE-2026-107914 refers to the vulnerability in which config.admin.inc does not ensure that a file_unmanaged_delete operation occurs, so many archives could persist.
Risk Assessment
Leftover configuration archives may be exposed or downloaded by unauthorized parties, potentially leading to leakage of sensitive system settings. There is also a separate config.module issue that could allow remote access by an anonymous user to the config.tar.gz file.
Recommendation
Update Backdrop CMS to version 1.34.5 or 1.35.1 (or later). Check for and remove unnecessary configuration archive files (config.tar.gz, config_0.tar.gz, etc.) from the server and restrict access to export directories.
Other vulnerabilities in Backdrop CMS
See all- CVE-2026-104476Medium
Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compressed archives generated by users with configuration export permission to obtain the full site configuration, including sensitive settings.
- CVE-2025-71310Low
The GDPR cookies module for Backdrop CMS before version 1.x-1.3.5 does not sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has been provided for the optional 'Info content' field for the YouTube service. The attack is mitigated by the fact that an attacker must have a role with permission to create or edit GDPR Cookies services and the site must have a YouTube service configured.
- CVE-2025-44141Medium
A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30. It allows injection of malicious JavaScript code into the page.
- CVE-2022-34530Medium
An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames.
Original NVD description (English source)
Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested by someone with the "Synchronize, import, and export configuration" permission. NOTE: CVE-2026-107914 refers to the vulnerability in which config.admin.inc does not ensure that a file_unmanaged_delete operation occurs. Therefore, many archives could persist: config.tar.gz, config_0.tar.gz, config_1.tar.gz, etc. There is a separate config.module issue that could allow remote access by an anonymous user, but only for the one filename config.tar.gz.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS