PatchTheCVEbackdrop cms vulnerabilities and fixes
Recent CVEs affecting backdrop cms, with upgrade or downgrade steps. 5 tracked.
Also searched as: backdropcms.
backdrop cms has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2025-11-18. Highest priority: CVE-2025-25062 (score 40/100).
- CVE-2025-44141 MEDIUM 6.1 DOWNGRADE A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30.
- CVE-2025-63828 MEDIUM 6.1 DOWNGRADE Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in p
- CVE-2025-25063 MEDIUM 4.4 UPGRADE An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3
- CVE-2025-25062 MEDIUM 4.4 UPGRADE An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3
- CVE-2024-54123 MEDIUM 6.1 UPGRADE Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed
FAQ
How do I fix backdrop cms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is backdrop cms being exploited right now?
None of the tracked backdrop cms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which backdrop cms CVE should I patch first?
CVE-2025-25062 currently ranks highest (40/100): An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3.