Configuration Export Vulnerability in Backdrop CMS by Backdrop
CVE-2026-107914

7.8HIGH

Key Information:

Vendor

Backdropcms

Status
Backdrop
Vendor
CVE Published:
9 October 2026

What is CVE-2026-107914?

Backdrop CMS versions 1.34 prior to 1.34.5 and 1.35 prior to 1.35.1 contain a vulnerability that fails to adequately secure configuration exports when users request a compressed archive. This oversight could potentially expose sensitive configuration data unless properly safeguarded by user permissions, specifically those having the 'Synchronize, import, and export configuration' rights. Addressing this issue is critical to maintain the integrity and security of the system.

Affected Version(s)

Backdrop 1.34.0 < 1.34.5

Backdrop 1.35.0 < 1.35.1

References

https://backdropcms.org/security/backdrop-sa-core-2026-006

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.