XSS Vulnerability in Flag Module for Backdrop CMS

CVE-2025-46595

What is CVE-2025-46595?

A Cross Site Scripting (XSS) vulnerability has been identified in the Flag module for Backdrop CMS prior to version 1.x-3.6.2. This module, which allows users to flag nodes, comments, and other entities, does not adequately validate flag links before executing the flag action or confirm that the returned response is authored by the flag module. As a result, this oversight could enable attackers with sufficient permissions—such as those who can create or edit comments or content with a filtered text format—to inject and execute arbitrary HTML, potentially compromising site security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References