Medium severity5.9NVD Advisory· Published Oct 3, 2026

CVE-2026-104476

Description

Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compressed archives generated by users with configuration export permission to obtain the full site configuration, including sensitive settings.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Backdropcms/Backdrop CMSllm-fuzzy
Range: <1.35.1
Backdropcms/Backdropllm-fuzzy
Range: <1.35.1

Patches

Vulnerability mechanics

References

backdropcms.org/security/backdrop-sa-core-2026-006nvd
github.com/backdrop/backdrop/commit/1ae67061d9d487bb6cb3b8611191354052f34749nvd
www.vulncheck.com/advisories/backdrop-cms-before-1.35.1-information-disclosure-via-configuration-export-archivenvd

News mentions

No linked articles in our index yet.

cvss	0.384
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000