CVE-2026-110907

HighCVSS 7.5

Published: 15/10/2026(UTC)Translated: 15/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

15th percentile - higher than 15% of all known CVEs

Summary

Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. The token browser does not sufficiently limit access to the types of tokens that are available, although the names of individual tokens are adequately protected.

Risk Assessment

An unauthorized user may gain access to token types that should be restricted, potentially exposing information or enabling unwanted actions on the site.

Recommendation

Update Backdrop CMS Core to version 1.35.2 or 1.34.6 (or later) and review access permissions for the token browser.

Other vulnerabilities in Backdrop CMS Core

CVE-2026-111442Medium
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags. By uploading a crafted SVG, it is possible to execute scripting in the browser when the SVG image is viewed directly by its URL. The issue is mitigated because Backdrop embeds all uploaded SVG images within <img> tags, which prevents script execution.

Original NVD description (English source)

Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type. The product doesn't sufficiently limit access to the types of tokens that are available in the token browser. The names of the individual tokens are adequately protected.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS