Backdrop CMS: Information disclosure via configuration export archives
Summary
Backdrop CMS versions before 1.35.1 (and 1.34.x before 1.34.5, according to the vendor advisory) leave configuration export archives on the server after transfer. An unauthenticated remote attacker who knows or finds such an archive can download it and obtain the full site configuration, including sensitive settings. The CVSS 4.0 score is 8.2 (High) with high attack complexity and a prerequisite condition, because an archive must first have been generated by a user with the configuration export permission.
Affected
- Backdrop CMS before 1.35.1 (per CVE record)
- Backdrop CMS 1.34.x before 1.34.5 (per vendor advisory BACKDROP-SA-CORE-2026-006; not listed in the CVE record)
- Versions 1.33 and older: no security coverage from the vendor
Fixed in
- Backdrop CMS 1.35.1
- Backdrop CMS 1.34.5
- Fix commit: 1ae67061d9d487bb6cb3b8611191354052f34749
- Newer patch releases are available; use the latest 1.35.x or 1.34.x release.
Workaround
- No vendor-issued workaround is known. The vendor's stated remedy is the upgrade.
- Limit the permission 'Synchronize, Import and Export Configuration' to a minimum of trusted roles.
- Check the web root and temporary or files directories for leftover configuration archives and remove them.
Exploitation
- No evidence of exploitation in the wild found.
- No verified public proof of concept.
- CISA SSVC: Exploitation none, Automatable no, Technical impact partial.
- EPSS: 0.00291 (Rapid7 aggregated data).
Our recommendation
- Upgrade all Backdrop sites to 1.35.1 or 1.34.5 at minimum, preferably the latest patch release.
- Prioritise internet-facing sites.
- Remove leftover configuration export archives and check whether any were reachable; if so, rotate database credentials, API keys and salts.
- Restrict the configuration export permission to trusted roles.
- Sites running 1.33 or older must be moved to a supported branch.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Backdrop CMS security advisory BACKDROP-SA-CORE-2026-006 backdropcms.org
- Backdrop CMS 1.35.1 release github.com
- Backdrop CMS releases github.com
- Fix commit 1ae67061d9d487bb6cb3b8611191354052f34749 github.com
- VulnCheck advisory www.vulncheck.com
- VulDB CVE-2026-104476 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:07.
Original description (NVD)
Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compressed archives generated by users with configuration export permission to obtain the full site configuration, including sensitive settings.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.