Backdrop CMS EUVD-2026-95489

Exploitation requires that a configuration export was previously generated by a user holding the 'Synchronize, import, and export configuration' permission - this is the vendor-stated mitigating prerequisite and is the key limiting factor. Without a prior export request, no insufficiently-protected archive exists to retrieve. The flaw concerns how the resulting compressed configuration archive is protected during delivery in Backdrop CMS 1.34.x (before 1.34.5) and 1.35.x (before 1.35.1); non-vulnerable branches and patched point releases are unaffected. The input vector's AC:H reflects this dependency on an out-of-band administrative action the attacker does not control.

The input CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N, base 7.8) contains internal tension that should be verified with the vendor. CWE-497 (Exposure of Sensitive System Information) and the 'Information Disclosure' tag point to a confidentiality-only weakness, yet the published vector asserts I:H and A:N with a scope change (S:C), which is unusual for a pure config-export disclosure - the integrity impact and scope change appear overstated. The vector also marks AV:L (local) while the described mechanism is delivery of a compressed configuration archive, which in a web CMS is typically retrieved over the network - AV:L versus the network-facing description should be confirmed. No EPSS score, CISA KEV entry, POC, or SSVC data was provided in the input; there is no public exploit identified at time of analysis. The high CVSS is driven largely by the contested I:H/S:C metrics; the practical risk is a confidentiality exposure that is further gated by AC:H and by the stated mitigation. Treat this as a moderate, conditions-dependent information-disclosure issue rather than a widely-weaponizable critical flaw, pending vendor clarification of the vector.

An attacker who can reach a Backdrop CMS 1.34.x/1.35.x site obtains the compressed configuration archive that was generated when a privileged administrator previously ran a configuration export, because the archive is not sufficiently protected during delivery. The exported configuration can expose sensitive settings and secrets. No public exploit code was identified at time of analysis, and exploitation depends on a prior export having been requested.