CVE-2026-111442

Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags. SVG images can contain clickable links or executable scripting. By uploading a crafted SVG, it is possible to execute scripting in the browser when an SVG image is viewed. This issue is mitigated by the attacker needing to be able to upload SVG images, and that Backdrop embeds all uploaded SVG images within <img> tags, which prevents script from executing. The SVG must be viewed directly by its URL in order to run any embedded scripting.

• CWE-79

• https://backdropcms.org/security/backdrop-sa-core-2026-007

Published

Oct 16, 2026

Last Modified

Oct 16, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-111409Missing Authorization vulnerability in YITH YITH PayPal Expr…5.3
• CVE-2026-11141Uninitialized Use in Audio in Google Chrome prior to 149.0.7…6.5
• CVE-2026-111413Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt…8.8
• CVE-2026-11142Insufficient policy enforcement in Paint in Google Chrome pr…6.5
• CVE-2026-11143Out of bounds read in Extensions in Google Chrome on Linux p…6.5
• CVE-2026-11144Use after free in Media in Google Chrome prior to 149.0.7827…8.8
• CVE-2026-111443Wheels 4.0.6 through 4.1.2 lets an unauthenticated client sw…6.5
• CVE-2026-111444Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB w…9.8
• CVE-2026-111445Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming sc…8.1
• CVE-2026-111446Wheels 4.0.0 through 4.1.2 exposes password-less development…8.6
• CVE-2026-111447Wheels 1.1 through 4.1.2 resolves nestedProperties() records…8.1
• CVE-2026-111448Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons…3.7