TI-2025-18732 Aliases CVE-2025-25063 GHSA-cfr9-prm9-crgr

Cross-site scripting in backdropcms backdrop

LOW 20CWE-79Published 2025-02-03 · Updated 2025-02-12

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: High
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG images to ensure they do not contain potentially dangerous SVG tags. SVG images can contain clickable links and executable scripting, and using a crafted SVG, it is possible to execute scripting in the browser when an SVG image is viewed. This issue is mitigated by the attacker needing to be able to upload SVG images, and that Backdrop embeds all uploaded SVG images within <img> tags, which prevents scripting from executing. The SVG must be viewed directly by its URL in order to run any embedded scripting.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.002 9th percentileScored 2026-11-07

Fix Fixed backdrop (backdropcms): 1.28.5, 1.29.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
backdropcms	backdrop	1.28.0 to before 1.28.5; 1.29.0 to before 1.29.3	1.28.5, 1.29.3	Patch available	CNA

backdrop Vendorbackdropcms Affected 1.28.0 to before 1.28.5; 1.29.0 to before 1.29.3 Fixed in 1.28.5, 1.29.3 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:backdropcms:backdrop_cms::::::::	1.28.0 to before 1.28.5; 1.29.0 to before 1.29.3	Vulnerable	backdropcms

cpe:2.3:a:backdropcms:backdrop_cms:*:*:*:*:*:*:*:* Versions 1.28.0 to before 1.28.5; 1.29.0 to before 1.29.3 Vulnerable ·backdropcms

Remediation

Fix · CNA backdrop (backdropcms) Fixed in 1.28.5, 1.29.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2025-02-03
backdropcms backdrop 1.28.5, 1.29.3
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2025-18731 Cross-site scripting in backdropcms backdropPriority MEDIUM 54
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2025-25063
2026-10-03 Alias added: GHSA-cfr9-prm9-crgr

References

Advisory 1

https://backdropcms.org/security/backdrop-sa-core-2025-002

TI-2025-39465 Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate… CVSS 3.1MEDIUM 6.1
TI-2023-14781 A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS… CVSS 3.1MEDIUM 4.8
TI-2022-20386 Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS)… CVSS 3.1MEDIUM 4.8
TI-2022-20385 Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS)… CVSS 3.1MEDIUM 4.8
TI-2025-18731 Cross-site scripting in backdropcms backdrop CVSS 3.1MEDIUM 4.4
TI-2019-10981 Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 allows the upload of… CVSS 3.0CRITICAL 9.8

See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences