CVE-2026-107914: Backdrop CMS Information Disclosure Flaw

CVE-2026-107914 Overview

CVE-2026-107914 affects Backdrop CMS versions 1.34 before 1.34.5 and 1.35 before 1.35.1. The flaw resides in config.admin.inc, which fails to invoke file_unmanaged_delete after a configuration export is delivered. As a result, archives such as config.tar.gz, config_0.tar.gz, and config_1.tar.gz persist in the temporary directory. A related issue in config.module allows anonymous retrieval of the single config.tar.gz filename. Exploitation requires that an export was previously requested by a user holding the "Synchronize, import, and export configuration" permission. The weakness is categorized as [CWE-459] (Incomplete Cleanup).

Critical Impact
Persistent configuration archives may expose complete site configuration data, including sensitive settings, to unauthorized access.

Affected Products

Backdrop CMS 1.34 before 1.34.5
Backdrop CMS 1.35 before 1.35.1
Core modules: config.admin.inc and config.module

Discovery Timeline

2026-10-09 - CVE-2026-107914 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-107914

Vulnerability Analysis

Backdrop CMS exports site configuration as a compressed tar.gz archive stored in the temporary filesystem. The export handler calls file_transfer() to stream the archive to the requester. Because file_transfer() terminates PHP execution via exit, the subsequent file_unmanaged_delete($file_path) statement never runs. Each new export creates a numerically suffixed file (config_0.tar.gz, config_1.tar.gz, and so on), accumulating sensitive configuration data in the temporary directory. A separate flaw in config_file_download() within config.module validates only the URI scheme and filename, letting any anonymous visitor who guesses the exact config.tar.gz path download it without permission checks.

Root Cause

The root cause is incomplete resource cleanup. The ordering of file_transfer() followed by file_unmanaged_delete() guarantees the cleanup call is unreachable. Combined with missing user_access() validation in the download handler, the archives become retrievable by unauthorized actors.

Attack Vector

An authenticated administrator with the "Synchronize, import, and export configuration" permission must first trigger an export. Afterward, a local or remote actor who can enumerate or guess the archive filename in the temporary stream may retrieve the configuration bundle. The archive contains the full site configuration, including integration settings and tokens.

text

// Patch excerpt: core/modules/config/config.admin.inc
     'Content-Disposition' => 'attachment; filename=config.tar.gz',
     'Content-type' => 'application/x-gzip',
   );
+  // file_transfer() exits after sending the file, so the temporary archive
+  // must be removed in a shutdown function to ensure it does not persist.
+  backdrop_register_shutdown_function('file_unmanaged_delete', $file_path);
   file_transfer('temporary://' . $filename, $headers);
-  file_unmanaged_delete($file_path);
 }

Source: GitHub Commit 1ae6706

The second patch segment adds a permission gate to the download handler:

text

// Patch excerpt: core/modules/config/config.module
 function config_file_download($uri) {
   $scheme = file_uri_scheme($uri);
   $target = file_uri_target($uri);
-  if ($scheme == 'temporary' && $target == 'config.tar.gz') {
+  if ($scheme == 'temporary' && $target == 'config.tar.gz' && user_access('synchronize configuration')) {
     return array(
       'Content-disposition' => 'attachment; filename="config.tar.gz"',
     );

Source: GitHub Commit 347c8e5

Detection Methods for CVE-2026-107914

Indicators of Compromise

Presence of config.tar.gz, config_0.tar.gz, config_1.tar.gz, or similarly numbered archives in the Backdrop temporary files directory.
Web server access log entries requesting config.tar.gz from unauthenticated or unexpected source addresses.
Multiple sequential configuration exports performed in a short time window without a corresponding administrative task.

Detection Strategies

Inventory the temporary files directory on Backdrop hosts and flag any file matching the pattern config*.tar.gz.
Correlate HTTP download events for config.tar.gz against the roster of accounts holding the "synchronize configuration" permission.
Alert on anonymous or low-privilege sessions successfully retrieving temporary:// resources.

Monitoring Recommendations

Enable file integrity monitoring on the Backdrop files/temporary path and ingest events into your SIEM.
Capture Backdrop watchdog logs for configuration export events and route them to centralized logging.
Baseline normal export cadence per administrator and alert on deviations.

How to Mitigate CVE-2026-107914

Immediate Actions Required

Upgrade Backdrop CMS to version 1.34.5 or 1.35.1 as published in the vendor advisory.
Manually delete any residual config*.tar.gz files from the temporary directory on affected hosts.
Audit account rosters to confirm only trusted users hold the "Synchronize, import, and export configuration" permission.

Patch Information

Fixes are available in commits 1ae6706 and 347c8e5. The patch registers file_unmanaged_delete via backdrop_register_shutdown_function so cleanup executes after file_transfer(), and adds a user_access('synchronize configuration') check to config_file_download(). Full details are in the Backdrop Security Advisory.

Workarounds

Restrict web server access to the Backdrop temporary files directory using server-level ACLs until patches are applied.
Add a cron job that purges leftover config*.tar.gz files from the temporary directory on a short interval.
Revoke the "synchronize configuration" permission from any non-essential role as a least-privilege control.

bash

# Remove persisted configuration archives from the Backdrop temporary directory
find /path/to/backdrop/files/temporary -maxdepth 1 -type f \
  -regex '.*/config\(_[0-9]+\)?\.tar\.gz' -print -delete