The vulnerability stems from insufficient validation of uploaded SVG images in Backdrop CMS Core. Malicious SVG files can embed links or executable scripting. When an attacker uploads a crafted SVG and a user views the file directly by its unique URL, browser‑side scripts can run. Backdrop normally embeds uploaded SVGs within <img> tags, which blocks script execution in that context; however, the risk remains if the file is accessed directly. The impact is a client‑side cross‑site scripting attack that can enable phishing, cookie theft, or other malicious actions.

BackdropCMS Backdrop versions 1.35.x prior to 1.35.2 and 1.34.x prior to 1.34.6 are affected. The fix is included in the 1.35.2 release and later releases. Site owners should update to Backdrop 1.35.2 or newer, such as the current 1.35.6 release, to remediate this weakness.

The CVSS score of 5.3 indicates moderate potential impact. The EPSS score is < 1%, signifying a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been observed. An attacker must have upload privileges and a victim must view the SVG directly via its URL. Because Backdrop allows content creators to upload SVGs, the attack surface exists primarily for users with upload rights; sites that disable SVG uploads or employ strict server‑side sanitization can significantly reduce risk.