CVE-2026-111442: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') in BackdropCMS Backdrop

Backdrop CMS Core versions 1.35.0 up to but not including 1.35.2 and 1.34.0 up to but not including 1.34.6 do not adequately validate uploaded SVG images to exclude potentially dangerous SVG tags. SVG images can include clickable links or executable scripting. An attacker who can upload a crafted SVG image may execute scripts in the browser if the SVG is accessed directly by its URL. However, when SVGs are embedded within <img> tags, script execution is prevented. This limits exploitation to scenarios where the SVG is viewed directly.

Successful exploitation allows an attacker with upload privileges to execute arbitrary scripts in the browser of users who directly access the malicious SVG image URL. This could lead to cross-site scripting attacks, potentially compromising user sessions or performing unauthorized actions within the context of the affected site. The attack requires the ability to upload SVG files and direct users to view them by URL, limiting the attack surface.

Users should upgrade Backdrop CMS to version 1.35.2 or later, or 1.34.6 or later, where this issue is fixed. Until patched, restrict SVG upload permissions to trusted users only and avoid direct linking to uploaded SVG files. Embedding SVGs within <img> tags mitigates script execution risk. No other vendor advisory information is available, so check official Backdrop CMS advisories for updates.