High 7.8Published Oct 9, 2026

CVE-2026-107914Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive.

Updated under an hour ago (2026-10-19 08:30 UTC)

Does this affect you?

It affects backdropcms Backdrop. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.12%, higher than 2% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for backdropcms Backdrop

Exploited in the last 30 days

Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested by someone with the "Synchronize, import, and export configuration" permission. NOTE: CVE-2026-107914 refers to the vulnerability in which config.admin.inc does not ensure that a file_unmanaged_delete operation occurs. Therefore, many archives could persist: config.tar.gz, config_0.tar.gz, config_1.tar.gz, etc. There is a separate config.module issue that could allow remote access by an anonymous user, but only for the one filename config.tar.gz.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Weakness (CWE): CWE-459
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.12% (percentile 2)
Assigned by: mitre
NVD analysis: Awaiting Analysis
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

backdropcms Backdrop backdropcms:backdrop (from the name)	from 1.34.0 before 1.34.5; from 1.35.0 before 1.35.1	CNA record

References

https://backdropcms.org/security/backdrop-sa-core-2026-006
https://github.com/backdrop/backdrop/commit/1ae67061d9d487bb6cb3b8611191354052f34749
https://github.com/backdrop/backdrop/commit/347c8e558254633205f431ce5c12321a7ae9248e

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.