CVE-2026-107914

Summary

Backdrop CMS allows configuration export files to persist indefinitely due to improper cleanup of temporary archive files, potentially exposing sensitive configuration data. The vulnerability occurs when config.admin.inc fails to properly delete exported archive files, leaving multiple versions like config.tar.gz, config_0.tar.gz, etc. accessible to users with the appropriate permissions.

Exploitability

Exploitation requires an attacker to have the 'Synchronize, import, and export configuration' permission, making it moderately difficult but not impossible to achieve, as it typically involves gaining access to a user account with these specific privileges.

Blast radius

If exploited, this vulnerability could expose sensitive configuration data including database credentials, API keys, and other system settings through persistent archive files that remain accessible on the server.

Detection

Monitor for persistent .tar.gz files in the configuration export directory, particularly config.tar.gz, config_0.tar.gz, config_1.tar.gz, etc., and watch for unusual file access patterns or attempts to read these archive files from web-accessible directories.

Prioritized remediation

Upgrade to Backdrop CMS 1.34.5 or 1.35.1 to address the configuration export cleanup issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.