rootpwn

high · CVSS v3 5.9 · CVSS v4 8.2

CVE-2026-104476

Backdrop CMS versions prior to 1.35.1 expose configuration export archives that remain on the server. An unauthenticated attacker can downlo

Overview

Backdrop CMS versions prior to 1.35.1 expose configuration export archives that remain on the server. An unauthenticated attacker can download these archives and view full site configuration, including sensitive settings. This vulnerability can leak administrative credentials and other secrets.

Description

Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compressed archives generated by users with configuration export permission to obtain the full site configuration, including sensitive settings.

Impact

Confidentiality: The vulnerability allows disclosure of site configuration, potentially revealing admin credentials, database passwords, and other secrets. Integrity: Not directly affected. Availability: Not affected. Defenders: Site administrators and security teams must ensure configuration archives are removed or protected.

Remediation

Apply the official patch to upgrade to Backdrop CMS 1.35.1 or later. If upgrade is not possible, delete any configuration export archives from the server or restrict web access to the export directory. Ensure file permissions prevent public read access.

Risk context

High severity with a CVSS v4 score of 8.2 indicates significant risk. Immediate attention is recommended, especially for sites that have left export archives accessible.

Affected products

  • Backdrop CMS

Scores

Severity
high
CVSS v2
5.4
CVSS v3
5.9
CVSS v4
8.2
EPSS
—

Backdrop CMS information disclosure configuration export high severity unauthenticated file disclosure

← All CVEs

Related CVEs

high

CVE-2026-104912

MISP before v2.5.48 has an authorization flaw in correlation handling during attribute searches. Correlated attributes and events can be authorized using a stale distribution snapshot instead of the live event access control list. This matters because restricted or unpublished events may remain visible to authenticated users who no longer have permission.

View analysis

high

CVE-2026-94544

CVE-2026-94544 exposes a cache sharing flaw in Next.js 16.3.0‑16.3.8 that allows unauthenticated users to see unpublished draft content or see published content in draft mode. The vulnerability arises when Cache Components or experimental.useCache are enabled and cached functions return draft‑dependent data. It can lead to accidental disclosure of sensitive content on public sites.

View analysis

high

CVE-2026-104433

Mooncake Transfer Engine versions prior to 0.3.12 contain an out‑of‑bounds read in the readString function that can be triggered by an unauthenticated attacker sending a zero‑length handshake frame. The flaw causes the service to crash, potentially disrupting SGLang inference servers or other applications using the engine. It is a high‑severity vulnerability that can lead to denial of service.

View analysis

high

CVE-2026-104478

Formwork versions prior to 2.3.13 have a path traversal flaw in BackupController that lets authenticated panel users read or delete arbitrary files. The vulnerability is triggered by a base64-encoded backslash-separated payload that bypasses PHP basename on Linux. It allows attackers with backup download or delete permissions to access files outside the backup directory.

View analysis