Servers and applications
CVE-2019-14771
Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives for invalid data, potentially allowing non-configuration scripts to be uploaded to the server. (This attack is mitigated by the attacker needing the "Synchronize, import, and export…
- Severity
- Critical 9.8
- Published
- 8 Aug 2019
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 1.12.8, 1.13.3
- Exploit chance
- 2.6% in the next 30 daysHigher than 85% of CVEs. EPSS by FIRST, 10 Nov 2026
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
Backdrop CMSServers and applications · cpe:a:backdropcms:backdrop_cms |
|