XSS Vulnerability in Backdrop CMS Affecting CKEditor 5
CVE-2025-25062
4.4MEDIUM
What is CVE-2025-25062?
An XSS vulnerability exists in Backdrop CMS that affects versions prior to 1.28.5 and 1.29.3 when using CKEditor 5. The issue arises from inadequate isolation of long text content, permitting an attacker with content creation permissions to inject malicious HTML and JavaScript into content. This risk materializes when administrators edit such content, potentially leading to unauthorized code execution. Mitigation relies on the complexity of leveraging this vulnerability, as the attacker must first exploit content creation capabilities.
Affected Version(s)
backdrop 1.28.0 < 1.28.5
backdrop 1.29.0 < 1.29.3
References
EPSS Score
35% chance of being exploited in the next 30 days.
CVSS V3.1
Score:
4.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved