BackdropCMS Backdrop up to 1.34.5/1.35.1 SVG image unrestricted upload

Summaryinfo

A vulnerability identified as critical has been detected in BackdropCMS Backdrop up to 1.34.5/1.35.1. This impacts an unknown function of the component SVG image Handler. This manipulation causes unrestricted upload. This vulnerability is registered as CVE-2026-111442. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in BackdropCMS Backdrop up to 1.34.5/1.35.1. It has been declared as critical. Affected by this vulnerability is some unknown functionality of the component SVG image Handler. The manipulation with an unknown input leads to a unrestricted upload vulnerability. The CWE definition for the vulnerability is CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags. SVG images can contain clickable links or executable scripting. By uploading a crafted SVG, it is possible to execute scripting in the browser when an SVG image is viewed. This issue is mitigated by the attacker needing to be able to upload SVG images, and that Backdrop embeds all uploaded SVG images within <img> tags, which prevents script from executing. The SVG must be viewed directly by its URL in order to run any embedded scripting.

The advisory is shared at backdropcms.org. This vulnerability is known as CVE-2026-111442 since 10/16/2026. The exploitation appears to be easy. The attack can be launched remotely. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1608.002 for this issue.

Upgrading to version 1.34.6 or 1.35.2 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• BackdropCMS

Name

• Backdrop

Version

• 1.34.0
• 1.34.1
• 1.34.2
• 1.34.3
• 1.34.4
• 1.34.5
• 1.35.0
• 1.35.1

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion