PT-2025-5616 · Unknown · Backdrop Cms

Grzegorz Misiun · Published 2025-02-03 · Updated 2025-02-03 · CVE-2025-25063

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Backdrop CMS versions 1.28.x through 1.28.4 Backdrop CMS versions 1.29.x through 1.29.2

Description: A security issue was discovered related to the validation of uploaded SVG images. These images can contain clickable links and executable scripting. An attacker could potentially execute scripting in the browser when an SVG image is viewed directly by its URL. However, the attacker must have the ability to upload SVG images, and the scripting is prevented from executing when the SVG is embedded within <img> tags.

Recommendations: For Backdrop CMS versions 1.28.x through 1.28.4, update to version 1.28.5 or later. For Backdrop CMS versions 1.29.x through 1.29.2, update to version 1.29.3 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-25063

Affected Products

Backdrop Cms

References · 5

• https://osv.dev/vulnerability/CVE-2025-25063 · Vendor Advisory
• https://backdropcms.org/security/backdrop-sa-core-2025-002 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25063 · Security Note
• https://t.me/cvedetector/17036 · Telegram Post
• https://twitter.com/CVEnew/status/1886267545595875485 · Twitter Post