Backdrop vulnerabilities

2 known vulnerabilities in Backdrop from BackdropCMS. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Backdrop: Incorrect Resource Transfer Between Spheres

  CVE-2026-110907Oct 15, 2026BackdropCMS

  Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type.

• 7.8 High severity

  Backdrop: Incomplete Cleanup

  CVE-2026-107914Oct 9, 2026BackdropCMS

  Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested by someone with the "