CVE-2026-107914
Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested by someone with the "Synchronize, import, and export configuration" permission. NOTE: CVE-2026-107914 refers to the vulnerability in which config.admin.inc does not ensure that a file_unmanaged_delete operation occurs. Therefore, many archives could persist: config.tar.gz, config_0.tar.gz, config_1.tar.gz, etc. There is a separate config.module issue that could allow remote access by an anonymous user, but only for the one filename config.tar.gz.
CVE-2026-107914
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-107914
Backdrop
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "backdropcms",
"product": "Backdrop",
"versions": [
{
"status": "affected",
"version": "1.34.0",
"lessThan": "1.34.5",
"versionType": "semver"
},
{
"status": "affected",
"version": "1.35.0",
"lessThan": "1.35.1",
"versionType": "semver"
}
],
"defaultStatus": "unknown"
}
]- Related CVEs
- CVE-2026-107914
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #21345 · Revision 1
- Added to Heist Feed
- Publisher date