CVE-2026-104476

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-104476
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104476.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-104476
Published
2026-10-02T23:28:46Z
Modified
2026-10-04T02:45:50Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Backdrop CMS before 1.35.1 Information Disclosure via Configuration Export Archive
Details

Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compressed archives generated by users with configuration export permission to obtain the full site configuration, including sensitive settings.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-200"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104476.json"
}
References

Affected packages

Git / github.com/backdrop/backdrop

Affected ranges

Type
GIT
Repo
https://github.com/backdrop/backdrop
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
aaefb3124b7b8d5dd84da9cde898ee8b784c47fa
Fixed
1ae67061d9d487bb6cb3b8611191354052f34749
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.35.1"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.1.0
1.10.0
1.11.0
1.13.0-preview
1.14.0
1.14.0-preview
1.15.0
1.15.0-preview
1.16.0
1.16.0-preview
1.17.0
1.17.0-preview
1.18.0
1.18.0-preview
1.19.0
1.19.0-preview
1.2.0
1.20.0
1.20.0-preview
1.21.0
1.21.0-preview
1.22.0
1.22.0-preview
1.23.0
1.23.0-preview
1.24.0
1.24.0-preview
1.25.0
1.25.0-preview
1.26.0
1.26.0-preview
1.27.0
1.27.0-preview
1.28.0
1.28.0-preview
1.29.0
1.29.0-preview
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.30.0
1.30.0-preview
1.31.0
1.31.0-preview
1.32.0
1.32.0-preview
1.33.0
1.33.0-preview
1.34.0
1.34.0-preview
1.35.0
1.35.0-preview
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.6.0
1.7.0
1.7.0-preview
v1.*
v1.0.0
v1.0.0-preview
v1.0.1
v1.0.2
v1.0.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104476.json"