Backdrop CMS Configuration Export Information Disclosure Vulnerability Advisory

Vulnerability Overview Vulnerability ID: BACKDROP-SA-CORE-2026-006 Publication Date: September 23, 2026 Severity: Critical Vulnerability Type: Information Disclosure Affected Versions Affected Versions: - Backdrop Core 1.35.x versions prior to 1.35.1 - Backdrop Core 1.34.x versions prior to 1.34.5 Description: Backdrop CMS fails to adequately protect configuration exports when providing compressed archives. The mitigation for this vulnerability is that the export must have been previously requested by someone with the "Synchronize, Import and Export Configuration" permission. Mitigation Solution: Upgrade to the latest version of Backdrop CMS. It can be downloaded from the Backdrop CMS 1.35.1 release page. Additional Information Reporter: Dilip Choudhary Fixes By: - Nate Lampton (Backdrop CMS Security Team) - Laryn Kragt Bakker (Backdrop CMS Security Team) Coordinated By: Nate Lampton (Backdrop CMS Security Team) Security Mailing List Backdrop maintains a security mailing list. When a security release is published, an email is sent to everyone subscribed to this list to announce the new version. Steps to Join: 1. Log in to backdropcms.org 2. Edit your profile 3. Switch to the "Subscriptions" tab 4. Check the box labeled "Security Updates" 5. Save the form Security Recommendations If you discover a security issue, please send an email to security@backdropcms.org. Do not submit issues on GitHub, nor publicly announce the issue. Security Advisories The page lists the latest security advisories, including projects in the Backdrop core and contributed repositories. Summary Vulnerability: Information Disclosure Impact: Configuration exports were not adequately protected Fix: Upgrade to the latest version Reporting: Report security issues via email

Goal Reached Thanks to every supporter — we hit 100%!

Backdrop CMS Configuration Export Information Disclosure Vulnerability Advisory