CVE-2026-107914

Katalog CVE

CVSS 7.8 · High EPSS 0,12%

Kerentanan Incomplete Cleanup. Skor CVSS 3.1 7.8 (High) menurut mitre.org.

Deskripsi (NVD)

Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested by someone with the "Synchronize, import, and export configuration" permission. NOTE: CVE-2026-107914 refers to the vulnerability in which config.admin.inc does not ensure that a file_unmanaged_delete operation occurs. Therefore, many archives could persist: config.tar.gz, config_0.tar.gz, config_1.tar.gz, etc. There is a separate config.module issue that could allow remote access by an anonymous user, but only for the one filename config.tar.gz.

Rincian

Terbit di NVD

9 Oktober 2026

Terakhir diubah

14 Oktober 2026

Status NVD

Awaiting Analysis

CVSS 3.1

7.8 (High), sumber mitre.org
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-459: Incomplete Cleanup

EPSS (30 hari)

0,12% peluang dieksploitasi; lebih tinggi dari 1,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://backdropcms.org/security/backdrop-sa-core-2026-006
• https://github.com/backdrop/backdrop/commit/1ae67061d9d487bb6cb3b8611191354052f34749
• https://github.com/backdrop/backdrop/commit/347c8e558254633205f431ce5c12321a7ae9248e