Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags. SVG images can contain clickable links or executable scripting. By upload…

{
                    "defaultStatus": "unaffected",
                    "product": "Backdrop",
                    "repo": "https://github.com/backdrop/backdrop",
                    "vendor": "BackdropCMS",
                    "versions": [
                        {
                            "lessThan": "1.35.2",
                            "status": "affected",
                            "version": "1.35.0",
                            "versionType": "semver"
                        },
                        {
                            "lessThan": "1.34.6",
                            "status": "affected",
                            "version": "1.34.0",
                            "versionType": "semver"
                        }
                    ]
                }