CVE-2026-104476: Backdrop CMS Information Disclosure Flaw

CVE-2026-104476 Overview

CVE-2026-104476 is an information disclosure vulnerability in Backdrop CMS versions before 1.35.1. The flaw allows unauthenticated attackers to download configuration export archives left on the server after transfer. These archives contain the full site configuration, including sensitive settings that can aid further compromise. The issue is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can retrieve a compressed archive containing the complete Backdrop CMS site configuration, exposing sensitive operational settings that support reconnaissance and follow-on attacks.

Affected Products

Backdrop CMS versions prior to 1.35.1
Backdrop CMS core/modules/config component (configuration export functionality)
Any Backdrop CMS deployment where users with the synchronize configuration permission have generated configuration exports

Discovery Timeline

2026-10-03 - CVE-2026-104476 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-104476

Vulnerability Analysis

The vulnerability resides in Backdrop CMS's configuration export workflow. When an authorized user exports site configuration, the system creates a temporary archive named config.tar.gz under the temporary:// stream wrapper. The archive is served to the user through file_transfer(), after which the file should be removed from disk.

Two issues allowed the archive to be retrieved by unauthenticated users. First, the file removal call placed after file_transfer() never executed, because file_transfer() terminates PHP execution. The archive persisted in the temporary directory. Second, the config_file_download() handler returned valid download headers for any request matching the known filename, without checking the requester's permissions. An unauthenticated attacker who knew or guessed the temporary URI could request config.tar.gz and receive the full configuration bundle.

Root Cause

The root cause is a combination of a missed cleanup step and missing authorization in a file download hook. backdrop_register_shutdown_function() was not used to schedule deletion, so the file leaked. The download handler lacked a user_access() check on the synchronize configuration permission.

Attack Vector

Exploitation requires network access to the Backdrop CMS site and knowledge of the fixed temporary archive filename config.tar.gz. No authentication is required. The attacker issues an HTTP GET request to the temporary file download endpoint and receives the archive if it has not been cleaned up.

text

// Security patch in core/modules/config/config.admin.inc
     'Content-Disposition' => 'attachment; filename=config.tar.gz',
     'Content-type' => 'application/x-gzip',
   );
+  // file_transfer() exits after sending the file, so the temporary archive
+  // must be removed in a shutdown function to ensure it does not persist.
+  backdrop_register_shutdown_function('file_unmanaged_delete', $file_path);
   file_transfer('temporary://' . $filename, $headers);
-  file_unmanaged_delete($file_path);
 }

Source: GitHub commit 1ae67061

text

// Security patch in core/modules/config/config.module
 function config_file_download($uri) {
   $scheme = file_uri_scheme($uri);
   $target = file_uri_target($uri);
-  if ($scheme == 'temporary' && $target == 'config.tar.gz') {
+  if ($scheme == 'temporary' && $target == 'config.tar.gz' && user_access('synchronize configuration')) {
     return array(
       'Content-disposition' => 'attachment; filename="config.tar.gz"',
     );

Source: GitHub commit 1ae67061

The patch adds a user_access('synchronize configuration') check and registers a shutdown function that removes the archive after transfer.

Detection Methods for CVE-2026-104476

Indicators of Compromise

Unauthenticated HTTP GET requests targeting the temporary configuration download URL for config.tar.gz.
Access log entries showing successful 200 OK responses to config.tar.gz requests from non-admin sessions.
Presence of config.tar.gz in the Backdrop CMS temporary files directory after a configuration export operation has completed.
Outbound transfers of large gzip payloads originating from the Backdrop CMS web root to external IP addresses.

Detection Strategies

Review Backdrop CMS access logs for requests matching the configuration archive filename and correlate against authenticated administrative sessions.
Alert on anonymous or low-privilege sessions receiving responses with Content-Type: application/x-gzip and Content-Disposition headers referencing config.tar.gz.
Compare file inventories of the temporary file directory against expected cleanup behavior to identify leaked archives.

Monitoring Recommendations

Enable web server access logging with full URI and client IP capture for the Backdrop CMS deployment.
Monitor file system events on the Backdrop temporary:// directory for creation of config.tar.gz and verify prompt deletion.
Forward web server and application logs to a centralized analytics platform to retain evidence and support historical hunts for prior exposure.

How to Mitigate CVE-2026-104476

Immediate Actions Required

Upgrade Backdrop CMS to version 1.35.1 or later as described in Backdrop SA-CORE-2026-006.
Delete any lingering config.tar.gz files from the Backdrop temporary:// directory on the server.
Rotate secrets, API keys, and credentials that may appear in exported configuration if an archive was accessible before patching.
Review web server access logs for prior unauthenticated requests to the configuration archive URL.

Patch Information

The fix is delivered in Backdrop CMS 1.35.1 and corresponds to upstream commit 1ae67061d9d487bb6cb3b8611191354052f34749. The patch adds a synchronize configuration permission check in config_file_download() and registers a shutdown function to remove the archive after file_transfer() completes. Additional context is available in the VulnCheck advisory.

Workarounds

Restrict network access to the Backdrop CMS administrative paths and temporary file endpoints using a web application firewall rule that blocks unauthenticated requests to config.tar.gz.
Manually remove config.tar.gz from the temporary files directory after each configuration export until the patch can be applied.
Temporarily revoke the synchronize configuration permission from non-essential roles to reduce the chance that an exported archive remains on disk.

bash

# Remove any leaked configuration archive and verify Backdrop CMS version
find /path/to/backdrop/files/tmp -name 'config.tar.gz' -print -delete
grep -R "BACKDROP_VERSION" /path/to/backdrop/core/includes/bootstrap.inc