Servers and applications
CVE-2019-19902
An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives for invalid data, allowing non-configuration scripts to potentially be uploaded to the server. This issue is mitigated by the fact that the attacker would be…
- Severity
- High 7.2
- Published
- 19 Dec 2019
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 1.13.5, 1.14.2
- Exploit chance
- 1.5% in the next 30 daysHigher than 74% of CVEs. EPSS by FIRST, 10 Nov 2026
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
Backdrop CMSServers and applications · cpe:a:backdropcms:backdrop_cms |
|