CVE-2026-111442 in Backdrop
Summary
by MITRE • 10/16/2026
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags. SVG images can contain clickable links or executable scripting. By uploading a crafted SVG, it is possible to execute scripting in the browser when an SVG image is viewed. This issue is mitigated by the attacker needing to be able to upload SVG images, and that Backdrop embeds all uploaded SVG images within <img> tags, which prevents script from executing. The SVG must be viewed directly by its URL in order to run any embedded scripting.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/16/2026
Backdrop CMS versions prior to 1.35.2 and 1.34.6 contain a vulnerability related to insufficient input validation of uploaded Scalable Vector Graphics files, specifically classified under CWE-79 for Cross-Site Scripting via SVG injection. The core issue stems from the system's failure to adequately sanitize or validate potentially dangerous tags within SVG content before storage. While modern web browsers often restrict script execution in images embedded directly into HTML pages through standard img tags, this protection is bypassed if an attacker can force a victim to view the malicious file as a standalone resource rather than as part of a larger document structure.
The technical flaw allows attackers who possess upload privileges for SVG files to embed executable JavaScript or clickable hyperlinks within the vector graphic data. When such a crafted SVG image is uploaded, it remains dormant until accessed in a specific manner. The vulnerability exploits the fact that if an SVG file is requested directly via its URL and rendered by a browser as a document rather than an embedded resource, any internal scripting elements will execute with the privileges of the viewing user's session. This mechanism effectively transforms a static image upload feature into a vector for stored cross-site scripting attacks.
The operational impact of this vulnerability depends heavily on the attacker's privilege level within the Backdrop CMS environment. Since mitigation is partially provided by the platform's default behavior of embedding uploaded SVGs in img tags, direct script execution does not occur during normal viewing contexts where images are displayed inline with other content. However, if an authenticated user can manipulate links to view their own or another user's uploaded SVG directly via its URL path, they may trigger arbitrary code execution. This could lead to session hijacking, defacement of the website by altering visual elements dynamically, or redirection to malicious external sites through embedded anchor tags within the graphic data.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1059, specifically Command and Scripting Interpretation via SVG scripts, as well as T1189 for Drive-by Client Compromise if combined with other exploits to target browser vulnerabilities associated with SVG parsing engines. The attack vector is primarily Local Privilege Escalation in the context of web application permissions, requiring initial access through valid credentials or a compromised account capable of media uploads.
To mitigate this risk, administrators should immediately upgrade Backdrop CMS to version 1.35.2 or later for the 1.35 branch and version 1.34.6 or later for the 1.34 branch, as these releases include enhanced validation logic that strips dangerous tags from uploaded SVG files before storage. Additionally, organizations should implement strict Content Security Policy headers to restrict script execution origins and consider deploying a Web Application Firewall configured to detect and block suspicious patterns in file uploads. Regular audits of user upload permissions can further reduce the attack surface by limiting who has the ability to introduce potentially malicious content into the system's media library.