Backdrop CMS versions 1.34 prior to 1.34.5 and 1.35 prior to 1.35.1 do not adequately protect configuration exports when delivering compressed archives. The flaw resides in config.admin.inc, which fails to trigger a file_unmanaged_delete operation, allowing multiple export files—config.tar.gz, config_0.tar.gz, config_1.tar.gz, and so on—to persist in the web‑root. An attacker who has already requested an export, a privilege that requires the “Synchronize, import, and export configuration” permission, can download these files. Additionally, a separate issue in config.module could allow an anonymous user to retrieve only config.tar.gz. This unchecked exposure creates a confidentiality risk for sensitive configuration data.

The vulnerability affects Backdrop CMS 1.34 releases older than 1.34.5 and Backdrop CMS 1.35 releases older than 1.35.1. Users running these versions should verify their current release and determine if it falls within the affected range.

The CVSS score of 7.8 classifies this flaw as high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack scenario requires an attacker to possess, or obtain, the “Synchronize, import, and export configuration” permission to request an export. Once that permission is in place, the attacker can download the compressed archive and read the configuration data. Because the export files are not deleted automatically, multiple archives may remain indefinitely, increasing the exposure window.