CVE-2026-104476

MEDIUM 5.9

Backdrop CMS before 1.35.1 Information Disclosure via Configuration Export Archive

CVSS Score

5.9

EPSS Score

0.0%

EPSS Percentile

0th

Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compressed archives generated by users with configuration export permission to obtain the full site configuration, including sensitive settings.

CWE	CWE-200
Vendor	backdrop
Product	backdrop
Published	Oct 2, 2026

Stay Ahead of the Next One

Get instant alerts for backdrop backdrop

Be the first to know when new medium vulnerabilities affecting backdrop backdrop are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

backdrop / backdrop

0 < 1.35.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/backdrop/backdrop/commit/1ae67061d9d487bb6cb3b8611191354052f34749 backdropcms.org: https://backdropcms.org/security/backdrop-sa-core-2026-006 github.com: https://github.com/backdrop/backdrop vulncheck.com: https://www.vulncheck.com/advisories/backdrop-cms-before-1.35.1-information-disclosure-via-configuration-export-archive

Credits

Dilip Choudhary