CVE-2026-107914: High severity Backdrop Backdrop CMS vulnerability
Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested by someone with the "Synchronize, import, and export configuration" permission. NOTE: CVE-2026-107914 refers to the vulnerability in which config.admin.inc does not ensure that a fileunmanageddelete operation occurs. Therefore, many archives could persist: config.tar.gz, config0.tar.gz, config1.tar.gz, etc. There is a separate config.module issue that could allow remote access by an anonymous user, but only for the one filename config.tar.gz.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Backdrop CMSto a version that resolves this vulnerability.Fixed in 1.34.5 - Upgrade
Upgrade
Backdrop CMSto a version that resolves this vulnerability.Fixed in 1.35.1 - Compensating control
Require the "Synchronize, import, and export configuration" permission before allowing a configuration export to be requested.
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Backdrop CMS sites running versions 1.34 before 1.34.5 or 1.35 before 1.35.1 are affected only if a configuration export has previously been requested by a user with the "Synchronize, import, and export configuration" permission.
What access does an attacker need to exploit it?
The vector is local and requires high attack complexity, but no privileges or user interaction are required according to the supplied severity metrics. Exploitation also depends on the prerequisite configuration export request.
What should be prioritized for remediation?
Upgrade affected 1.34 installations to 1.34.5 or later, and affected 1.35 installations to 1.35.1 or later. Review which users hold the configuration synchronization, import, and export permission, since use of that permission to request an export is a stated prerequisite.