Backdrop CMS EUVD-2026-91852

Exploitation requires that a user holding the 'synchronize configuration' (configuration export) permission has recently generated a full configuration export, producing a temporary config.tar.gz archive that, before the patch, was not reliably removed after transfer and was served from the temporary:// scheme without an authorization check. The limiting factors are significant: the target archive is transient (CVSS AT:P/AC:H reflect that the attacker must catch or find a leftover file rather than trigger it on demand), so an environment that never uses configuration export is not exposed, and after upgrading to 1.35.1 anonymous requests to the temporary config.tar.gz return HTTP 403. No authentication is required (PR:N) and no user interaction by the victim is needed at exploit time, but the precondition of an existing leftover export archive is mandatory.

This is a credible but conditional information-disclosure flaw rather than a mass-exploitable critical bug. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) scores 8.2 largely due to VC:H (full site configuration exposure) combined with network reach and no required privileges, but two mitigating signals temper that: AC:H and AT:P indicate the attack is neither straightforward nor reliably repeatable - exploitation depends on a transient temporary archive (config.tar.gz) existing on the server, which the source diff confirms was only left behind after a privileged user performed a configuration export. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not confirmed actively exploited and POC availability is unknown. The reporter (VulnCheck) and the vendor security advisory (backdrop-sa-core-2026-006) plus the fixing commit are confirmed, lending high confidence to the technical root cause. Net: a real priority for Backdrop operators who use configuration export, but the race-condition/transient-file nature and niche product footprint make widespread opportunistic exploitation unlikely - treat as targeted-risk rather than wormable.

An administrator with 'synchronize configuration' permission generates a full configuration export, producing a temporary config.tar.gz archive. Because the file was not reliably deleted after transfer and the temporary scheme served it without an access check, an unauthenticated remote attacker who requests the predictable temporary archive path (or catches it before cleanup) downloads the full site configuration, including sensitive settings such as API keys and credentials. No public exploit is identified at time of analysis; success depends on the archive still being present on the server.