UpHeron
All vulnerabilities

Servers and applications

CVE-2026-111442

Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags. SVG images can contain clickable links or executable scripting. By uploading a crafted SVG, it is possible to execute scripting in the browser when an SVG image is viewed. This issue is mitigated by the attacker needing to be able…

Severity
Medium 5.3
Published
16 Oct 2026
Last changed
21 Oct 2026
Added to UpHeron
3 Nov 2026
Fixed in
1.34.6, 1.35.2
Sources
CVE Program

Affected software

SoftwareAffected versions
Backdrop CMSServers and applications · cna:backdropcms|backdrop
  • From 1.34.0 before 1.34.6
  • From 1.35.0 before 1.35.2

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-111442