XSS Vulnerability in Backdrop CMS Affecting CKEditor 5

CVE-2025-25062

What is CVE-2025-25062?

An XSS vulnerability exists in Backdrop CMS that affects versions prior to 1.28.5 and 1.29.3 when using CKEditor 5. The issue arises from inadequate isolation of long text content, permitting an attacker with content creation permissions to inject malicious HTML and JavaScript into content. This risk materializes when administrators edit such content, potentially leading to unauthorized code execution. Mitigation relies on the complexity of leveraging this vulnerability, as the attacker must first exploit content creation capabilities.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References