CVE-2026-111442 Overview
CVE-2026-111442 is a stored cross-site scripting (XSS) vulnerability in Backdrop CMS Core affecting versions 1.35.x before 1.35.2 and 1.34.x before 1.34.6. The flaw stems from insufficient validation of uploaded Scalable Vector Graphics (SVG) files, which can contain embedded scripting or clickable links. An authenticated user with upload privileges can store a crafted SVG that executes JavaScript in a victim's browser when the file is viewed directly by URL. The issue is tracked under CWE-79.
Critical Impact
Attackers with upload permissions can execute arbitrary JavaScript in victim browsers, enabling session theft, phishing, or Backdrop administrative account compromise through direct SVG URL access.
Affected Products
- Backdrop CMS Core 1.35.x before 1.35.2
- Backdrop CMS Core 1.34.x before 1.34.6
- Backdrop CMS installations that permit SVG file uploads
Discovery Timeline
- 2026-10-16 - CVE-2026-111442 published to the National Vulnerability Database (NVD)
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-111442
Vulnerability Analysis
Backdrop CMS accepts SVG file uploads through its standard file handling subsystem. SVG is an XML-based image format that supports embedded <script> elements, event handlers such as onload, and clickable <a> tags. Backdrop does not strip these active elements from uploaded files prior to storage.
The vendor applies a partial mitigation by rendering uploaded SVGs inside HTML <img> tags on content pages. Browsers do not execute scripts within SVGs loaded through <img> references, so inline exploitation on article pages is blocked. The mitigation fails when a user navigates directly to the SVG file URL under the site's public files directory. In that context, the browser treats the response as a standalone SVG document and executes any embedded scripting.
Root Cause
The root cause is missing output sanitization of SVG XML before persistence. Backdrop does not parse uploaded SVG content and remove dangerous elements such as <script>, <foreignObject>, or event-handler attributes. This maps to CWE-79: Improper Neutralization of Input During Web Page Generation.
Attack Vector
Exploitation requires an authenticated account with file upload rights, limiting the attack surface to internal users or sites that allow self-registration with upload capabilities. The attacker uploads an SVG containing a <script> block or a tag with an event handler. The attacker then distributes the direct file URL to victims. When a victim loads the URL, the embedded script executes in the browser under the Backdrop site's origin, enabling cookie theft, session riding, or forced administrative actions. See the Backdrop Security Advisory #2026-007 for additional technical details.
Detection Methods for CVE-2026-111442
Indicators of Compromise
- SVG files in the Backdrop files/ directory containing <script>, onload, onclick, or <foreignObject> elements
- Web server access logs showing direct GET requests to .svg URLs followed by outbound requests to attacker-controlled domains
- New or modified .svg uploads from low-privilege user accounts not previously associated with media management
Detection Strategies
- Scan the Backdrop file storage directory for SVG files containing script tags, event handler attributes, or external references using XML or regex parsers
- Review Backdrop audit logs for recent SVG uploads correlated with user accounts that lack a legitimate content-authoring role
- Hunt for referrer patterns where .svg responses precede authentication state changes or administrative API calls
Monitoring Recommendations
- Alert on HTTP responses with Content-Type: image/svg+xml that contain script payloads in body inspection rules
- Monitor for anomalous session activity following direct SVG URL views, including privilege changes or user creation events
- Track upload volume per user account and flag accounts that deviate from baseline file-upload behavior
How to Mitigate CVE-2026-111442
Immediate Actions Required
- Upgrade Backdrop CMS Core to version 1.35.2 or 1.34.6 as specified in the Backdrop Security Advisory #2026-007
- Audit existing SVG uploads for malicious content and remove any files containing script elements or event handlers
- Review user roles and revoke SVG upload permissions from accounts that do not require them
Patch Information
Backdrop CMS has released fixed versions 1.35.2 and 1.34.6. The patches add validation that strips dangerous SVG elements before storing uploaded files. Administrators should apply updates through the standard Backdrop update workflow and verify the installed version in the admin dashboard after upgrading.
Workarounds
- Disable SVG uploads entirely by removing svg from the allowed file extensions in Backdrop field settings until patches are applied
- Configure the web server to serve .svg files with Content-Disposition: attachment to force download instead of inline rendering
- Apply a Content Security Policy header on the files directory that blocks inline script execution for SVG responses
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
