BackdropCMS vulnerabilities
We track 4 vulnerabilities in BackdropCMS products across 3 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 15, 2026.
Latest BackdropCMS vulnerabilities
- 7.5 High severity
Backdrop: Incorrect Resource Transfer Between Spheres
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type.
- 7.8 High severity
Backdrop: Incomplete Cleanup
Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested by someone with the "
- 7.5 High severity
Masquerade: Incorrect Authorization
An issue was discovered in the Masquerade module before 1.x-1.0.1 for Backdrop CMS. It allows people to temporarily switch to another user account. The module provides a "Masquerade as admin" permission to restrict people (who can masquerade) from switching to
- 7.2 High severity
Backdrop CMS: Unrestricted Upload of File with Dangerous Type
Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution. Note: Third parties dispute this and argue that advanced permissions are required.