XSS Vulnerability in Flag Module for Backdrop CMS
CVE-2025-46595

6.4MEDIUM

Key Information:

Vendor

Backdropcms

Status
Flag
Vendor
CVE Published:
25 April 2025

What is CVE-2025-46595?

A Cross Site Scripting (XSS) vulnerability has been identified in the Flag module for Backdrop CMS prior to version 1.x-3.6.2. This module, which allows users to flag nodes, comments, and other entities, does not adequately validate flag links before executing the flag action or confirm that the returned response is authored by the flag module. As a result, this oversight could enable attackers with sufficient permissions—such as those who can create or edit comments or content with a filtered text format—to inject and execute arbitrary HTML, potentially compromising site security.

Affected Version(s)

Flag 0 < 1.x-3.6.2

References

https://backdropcms.org/security/backdrop-sa-contrib-2025...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-46595 : XSS Vulnerability in Flag Module for Backdrop CMS