Backdrop CMS EUVD-2026-102595

Exploitation requires (1) an authenticated Backdrop CMS account with permission to upload SVG images (PR:L), and (2) a victim who opens the uploaded SVG directly via its raw file URL rather than viewing it on a normal page. The key limiting factor is Backdrop's design of embedding all uploaded SVGs within <img> tags, which blocks script execution in ordinary rendering - so a victim must be induced to navigate straight to the SVG's URL for any embedded scripting to run. Affected only on Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6; it is not remote-unauthenticated against default configurations because the upload privilege and the direct-URL viewing step are both prerequisites.

This is a moderate-severity stored cross-site scripting (CWE-79) issue in Backdrop CMS core, and the available signals converge on genuinely limited real-world risk rather than an urgent priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N, base 5.3) indicates network reachability with low attack complexity but requires authenticated privileges (PR:L) - specifically an account permitted to upload files/images. There is no EPSS score provided, no CISA KEV listing, and no public POC referenced, so exploitation status is: no public exploit identified at time of analysis. Two strong mitigating factors cut against the headline CVSS: Backdrop embeds uploaded SVGs inside <img> tags, which does not execute embedded script, so the attacker's payload only runs if a victim manually navigates directly to the raw SVG file URL. The CVSS vector marks VC:N (no confidentiality impact) and UI:N, but these appear understated/inconsistent for a reflected-in-browser XSS: script execution in a victim's authenticated session can plausibly expose session data (arguing C:L) and realistically requires a victim to open the SVG URL (arguing user interaction) - verify these metric choices with the vendor advisory. Net assessment: a real but low-to-moderate bug gated behind both an upload-capable account and an unusual victim action (direct URL viewing), making opportunistic mass exploitation unlikely.

An authenticated user with permission to upload images uploads a crafted SVG containing embedded JavaScript or a clickable link. Because Backdrop renders SVGs inside <img> tags, the script stays dormant on normal pages; the attacker then lures a victim (e.g., an administrator) into opening the raw SVG file by its direct URL, at which point the browser executes the embedded script in the site's origin. No public exploit code has been identified at time of analysis.