What’s Vulnerable › Vulnerabilities
CVE-2026-110907
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-15 · updated 2026-10-19
- Weakness: CWE-669
Description
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type. The product doesn't sufficiently limit access to the types of tokens that are available in the token browser. The names of the individual tokens are adequately protected.
Affected products
- BackdropCMS Backdrop: from 1.35.0 before 1.35.2; from 1.34.0 before 1.34.6 — fixed in 1.34.6, 1.35.2
How to fix
Upgrade to a fixed version: BackdropCMS Backdrop 1.34.6, 1.35.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-110907 or the next vulnerability affects your stack