CVE-2025-25063: XSS
First published: Mon Feb 03 2025(Updated: )
An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG images to ensure they do not contain potentially dangerous SVG tags. SVG images can contain clickable links and executable scripting, and using a crafted SVG, it is possible to execute scripting in the browser when an SVG image is viewed. This issue is mitigated by the attacker needing to be able to upload SVG images, and that Backdrop embeds all uploaded SVG images within <img> tags, which prevents scripting from executing. The SVG must be viewed directly by its URL in order to run any embedded scripting.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Backdrop | <1.28.5 | |
| Backdrop | <1.29.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-25063?
CVE-2025-25063 is classified as a high severity vulnerability due to the potential for Cross-Site Scripting (XSS) exploitation.
How do I fix CVE-2025-25063?
To fix CVE-2025-25063, upgrade Backdrop CMS to version 1.28.5 or 1.29.3 or later.
What versions of Backdrop CMS are affected by CVE-2025-25063?
CVE-2025-25063 affects Backdrop CMS versions 1.28.x before 1.28.5 and 1.29.x before 1.29.3.
What types of attacks can CVE-2025-25063 enable?
CVE-2025-25063 can enable Cross-Site Scripting (XSS) attacks, allowing attackers to execute scripts in the context of a user's browser.
What is the main issue with SVG uploads in CVE-2025-25063?
The main issue in CVE-2025-25063 is inadequate validation of uploaded SVG images, which may allow them to contain dangerous SVG tags.
- agent/references
- agent/first-publish-date
- agent/type
- agent/description
- collector/nvd-api
- source/NVD
- agent/author
- agent/source
- agent/tags
- agent/weakness
- agent/severity
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/epss
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/epss-latest
- source/FIRST
- agent/softwarecombine
- vendor/backdrop
- canonical/backdrop