UpHeron
All vulnerabilities

Servers and applications

CVE-2025-25063

An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG images to ensure they do not contain potentially dangerous SVG tags. SVG images can contain clickable links and executable scripting, and using a crafted SVG, it is possible to execute scripting in the browser when an SVG image is viewed. This issue is…

Severity
Medium 4.4
Published
3 Feb 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.28.5, 1.29.3
Sources
NVD

Affected software

SoftwareAffected versions
Backdrop CMSServers and applications · cpe:a:backdropcms:backdrop_cms
  • From 1.28.0 before 1.28.5
  • From 1.29.0 before 1.29.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-25063
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-25063