Threats affecting pkg:composer/backdrop/backdrop

Backdrop CMS versions 1.34 before 1.34.5 and 1.35 before 1.35.1 have a vulnerability where configuration export archives are not properly cleaned up after creation. This can lead to multiple configuration archive files persisting on the system. The vulnerability requires that the export operation was previously requested by a user with the 'Synchronize, import, and export configuration' permission. A related issue allows remote anonymous access to one specific archive filename, but this is separate from the main incomplete cleanup flaw.

Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed for a text format.