TI-2025-18731 Aliases CVE-2025-25062 GHSA-vrh8-g8q9-jhc6

Cross-site scripting in backdropcms backdrop

MEDIUM 54CWE-79Published 2025-02-03 · Updated 2025-05-09

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: High
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor 5 rich text editor is used. This allows a potential attacker to craft specialized HTML and JavaScript that may be executed when an administrator attempts to edit a piece of content. This vulnerability is mitigated by the fact that an attacker must have the ability to create long text content (such as through the node or comment forms) and an administrator must edit (not view) the content that contains the malicious content. This problem only exists when using the CKEditor 5 module.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01721 77th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix Fixed backdrop (backdropcms): 1.28.5, 1.29.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
backdropcms	backdrop	1.28.0 to before 1.28.5; 1.29.0 to before 1.29.3	1.28.5, 1.29.3	Patch available	CNA

backdrop Vendorbackdropcms Affected 1.28.0 to before 1.28.5; 1.29.0 to before 1.29.3 Fixed in 1.28.5, 1.29.3 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:backdropcms:backdrop_cms::::::::	1.28.0 to before 1.28.5; 1.29.0 to before 1.29.3	Vulnerable	backdropcms

cpe:2.3:a:backdropcms:backdrop_cms:*:*:*:*:*:*:*:* Versions 1.28.0 to before 1.28.5; 1.29.0 to before 1.29.3 Vulnerable ·backdropcms

Remediation

Fix · CNA backdrop (backdropcms) Fixed in 1.28.5, 1.29.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2025-02-03
backdropcms backdrop 1.28.5, 1.29.3
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2025-18732 Cross-site scripting in backdropcms backdropPriority LOW 20
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2025-25062
2026-10-03 Alias added: GHSA-vrh8-g8q9-jhc6

References

Exploit 2

Advisory 1

https://backdropcms.org/security/backdrop-sa-core-2025-001

TI-2025-39465 Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate… CVSS 3.1MEDIUM 6.1
TI-2023-14781 A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS… CVSS 3.1MEDIUM 4.8
TI-2022-20386 Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS)… CVSS 3.1MEDIUM 4.8
TI-2022-20385 Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS)… CVSS 3.1MEDIUM 4.8
TI-2019-10981 Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 allows the upload of… CVSS 3.0CRITICAL 9.8
TI-2022-20383 Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows… CVSS 3.1HIGH 7.2

See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences