CVE-2026-107914

Published: Ott 09, 2026 Last Modified: Ott 09, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,8
Source: [email protected]
Attack Vector: local
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: changed
Confidentiality: high
Integrity: high
Availability: none

Description

AI Translation Available

Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested by someone with the 'Synchronize, import, and export configuration' permission. NOTE: CVE-2026-107914 refers to the vulnerability in which config.admin.inc does not ensure that a file_unmanaged_delete operation occurs. Therefore, many archives could persist: config.tar.gz, config_0.tar.gz, config_1.tar.gz, etc. There is a separate config.module issue that could allow remote access by an anonymous user, but only for the one filename config.tar.gz.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0012
Percentile
0,0th
Updated

EPSS Score Trend (Last 3 Days)

459

Incomplete Cleanup

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Other Confidentiality Integrity
Potential Impacts:
Other Read Application Data Modify Application Data Dos: Resource Consumption (Other)
Applicable Platforms
All platforms may be affected
View CWE Details
https://backdropcms.org/security/backdrop-sa-core-2026-006
https://backdropcms.org/security/backdrop-sa-core-2026-006
https://github.com/backdrop/backdrop/commit/1ae67061d9d487b…
https://github.com/backdrop/backdrop/commit/1ae67061d9d487bb6cb3b8611191354052f…
https://github.com/backdrop/backdrop/commit/347c8e558254633…
https://github.com/backdrop/backdrop/commit/347c8e558254633205f431ce5c12321a7ae…