TI-2025-29307 Aliases CVE-2025-46595 GHSA-qgfc-q68c-8fgx

Cross-site scripting in backdropcms Flag

LOW 28CWE-79Published 2025-04-25 · Updated 2025-04-25

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

An XSS issue was discovered in the Flag module before 1.x-3.6.2 for Backdrop CMS. Flag is a module that allows flags to be added to nodes, comments, users, and any other type of entity. It doesn't verify flag links before performing the flag action, or verify that the response returned was provided by the flag module. This can allow crafted HTML to result in Cross Site Scripting. This is mitigated by the fact that an attacker must have a role with permission to create links on the website, for example: create or edit comments or content with a filtered text format.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00245 15th percentileScored 2026-11-07

Fix Fixed Flag (backdropcms): 1.x-3.6.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
backdropcms	Flag	before 1.x-3.6.2	1.x-3.6.2	Patch available	CNA

Flag Vendorbackdropcms Affected before 1.x-3.6.2 Fixed in 1.x-3.6.2 Patch available CNA

Remediation

Fix · CNA Flag (backdropcms) Fixed in 1.x-3.6.2

Timeline

2026-10-02 Threatist record created from CVE-2025-46595
2026-10-03 Alias added: GHSA-qgfc-q68c-8fgx

References

Other 1

https://backdropcms.org/security/backdrop-sa-contrib-2025-011

TI-2019-08480 jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles… CVSS 3.1MEDIUM 6.1
TI-2025-39465 Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate… CVSS 3.1MEDIUM 6.1
TI-2023-14781 A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS… CVSS 3.1MEDIUM 4.8
TI-2022-20387 Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' . CVSS 3.1MEDIUM 4.8
TI-2022-20386 Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS)… CVSS 3.1MEDIUM 4.8
TI-2022-20385 Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS)… CVSS 3.1MEDIUM 4.8

See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences