CVE-2025-25063: backdropcms backdrop cms

csirt@kutim:~/threat-intel/cve/CVE-2025-25063

CVSS 4.4 · Medium EPSS 0,20%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada backdropcms backdrop cms. Skor CVSS 3.1 4.4 (Medium) menurut mitre.org.

Deskripsi (NVD)

An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG images to ensure they do not contain potentially dangerous SVG tags. SVG images can contain clickable links and executable scripting, and using a crafted SVG, it is possible to execute scripting in the browser when an SVG image is viewed. This issue is mitigated by the attacker needing to be able to upload SVG images, and that Backdrop embeds all uploaded SVG images within <img> tags, which prevents scripting from executing. The SVG must be viewed directly by its URL in order to run any embedded scripting.

Rincian

Terbit di NVD: 3 Februari 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 4.4 (Medium), sumber mitre.org
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 0,20% peluang dieksploitasi; lebih tinggi dari 9,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
backdropcms	backdrop cms	Versi 1.28.0 hingga sebelum 1.28.5
backdropcms	backdrop cms	Versi 1.29.0 hingga sebelum 1.29.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://backdropcms.org/security/backdrop-sa-core-2025-002 advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.