XSS Vulnerability in Backdrop CMS Affecting CKEditor 5

CVE-2025-25062

What is CVE-2025-25062?

An XSS vulnerability exists in Backdrop CMS that affects versions prior to 1.28.5 and 1.29.3 when using CKEditor 5. The issue arises from inadequate isolation of long text content, permitting an attacker with content creation permissions to inject malicious HTML and JavaScript into content. This risk materializes when administrators edit such content, potentially leading to unauthorized code execution. Mitigation relies on the complexity of leveraging this vulnerability, as the attacker must first exploit content creation capabilities.

References