CVE-2026-107914: High severity Backdrop Backdrop CMS vulnerability
Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested by someone with the "Synchronize, import, and export configuration" permission.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Backdrop CMSto a version that resolves this vulnerability.Fixed in 1.34.5 - Upgrade
Upgrade
Backdrop CMSto a version that resolves this vulnerability.Fixed in 1.35.1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Backdrop CMS sites running versions 1.34 before 1.34.5 or 1.35 before 1.35.1 are affected only if a configuration export has previously been requested by a user with the "Synchronize, import, and export configuration" permission.
What access does an attacker need to exploit it?
The vector is local and requires high attack complexity, but no privileges or user interaction are required according to the supplied severity metrics. Exploitation also depends on the prerequisite configuration export request.
What should be prioritized for remediation?
Upgrade affected 1.34 installations to 1.34.5 or later, and affected 1.35 installations to 1.35.1 or later. Review which users hold the configuration synchronization, import, and export permission, since use of that permission to request an export is a stated prerequisite.