CVE-2026-104476

5.9 MEDIUMpublic exploit available

Published 2026-10-03 · Updated 2026-10-06

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compressed archives generated by users with configuration export permission to obtain the full site configuration, including sensitive settings.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-200

Public exploit & PoC references

https://github.com/backdrop/backdrop
https://github.com/backdrop/backdrop/commit/1ae67061d9d487bb6cb3b8611191354052f34749

All references

https://backdropcms.org/security/backdrop-sa-core-2026-006
https://github.com/backdrop/backdrop
https://github.com/backdrop/backdrop/commit/1ae67061d9d487bb6cb3b8611191354052f34749
https://www.vulncheck.com/advisories/backdrop-cms-before-1.35.1-information-disclosure-via-configuration-export-archive

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-100149PoC
HIGHCVE-2026-100241
HIGHCVE-2026-100244
MEDIUMCVE-2026-100286
UNSCOREDCVE-2026-100377
UNSCOREDCVE-2026-100379PoC
UNSCOREDCVE-2026-100406PoC
MEDIUMCVE-2026-100418PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.