CVE-2026-111442Published

Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags. SVG images can contain clickable links or executable scripting. By upload…

Exact source revision recorded 23 Oct 2026 15:48:27 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

cve-program · CVE-2026-111442

Published

Backdrop

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "defaultStatus": "unaffected",
                    "product": "Backdrop",
                    "repo": "https://github.com/backdrop/backdrop",
                    "vendor": "BackdropCMS",
                    "versions": [
                        {
                            "lessThan": "1.35.2",
                            "status": "affected",
                            "version": "1.35.0",
                            "versionType": "semver"
                        },
                        {
                            "lessThan": "1.34.6",
                            "status": "affected",
                            "version": "1.34.0",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON