Security Advisories

The Backdrop CMS project uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update that impacts Backdrop, along with a hotfix for that update.

Vulnerabilities are possible if Backdrop is configured to allow use of the CKEditor library for Rich-Text editing. An attacker that can create or edit content (even without access to the Editor themselves) may be able to exploit one or more Cross-Site Scripting (XSS) vulnerabilities to target other people who do have access to the Rich-Text Editor, including site admins with privileged access.

For more information, see CKEditor's security advisories.

The Backdrop project uses the CKEditor library for Rich-Text editing. CKEditor has released a security update that impacts Backdrop.

Vulnerabilities are possible if Backdrop remains configured to use the CKEditor library for Rich-Text editing. 

An attacker that can enter or edit content as formatted text (even without access to Rich-Text editor themselves) may be able to exploit one or more Cross-Site Scripting (XSS) vulnerabilities to target other people who have permission to use the Rich-Text editor on the same content, including site admins with privileged access.

If you're using the fakeobjects CKEditor plugin (not included with core) you will also want to update this.

The Backdrop Security Team will be coordinating a security release for Backdrop 1.19 and 1.18 this week on Thursday, August 12, 2021. 

We are issuing this PSA in advance because August 12, 2021 is not a security window in the regular Drupal security release window schedule, and since we coordinate security releases with Drupal, there would not normally be any security release on this date.

The Backdrop core release will be made between 16:00 – 22:00 UTC (noon – 6:00pm EDT). It is rated as moderately critical and will be an update to a vendor library only.

The Backdrop project uses the pear Archive_Tar library, which has released a security update that impacts Backdrop.

The vulnerability is mitigated by the fact that Backdrop core's use of the Archive_Tar library is not vulnerable, as it does not permit symlinks. Backdrop also does not use Archive_Tar in normal operation of the site, but maintains it for compatibility with contrib modules and custom code.

Exploitation may be possible if contrib or custom code uses the library to extract tar archives (for example .tar, .tar.gz, .bz2, or .tlz) which come from a potentially untrusted source.

Backdrop core uses the third-party CKEditor library. This library has an error in parsing HTML that could lead to an XSS attack.

Update: 2021-06-11: More details are available on CKEditor's blog.

Backdrop core's sanitization API fails to properly filter cross-site scripting under certain circumstances. 

Not all sites and users are affected, but configuration changes to prevent the exploit might be impractical and will vary between sites. Therefore, we recommend all sites update to this release as soon as possible.

The Backdrop project uses the pear Archive_Tar library, which has released a security update that impacts Backdrop. For more information please see:

• CVE-2020-36193

Exploits may be possible if Backdrop is configured to allow .tar, .tar.gz, .bz2, or .tlz file uploads and processes them, or if the Installer module is enabled.

There will be a security release of Backdrop 1.18.x, and 1.17.x on January 27th, 2021 between 19:00 - 23:00 UTC. Security release announcements will appear here, on the Backdrop security page. This release will not require a database update.

The PEAR Archive_Tar library included with Backdrop core released a security update earlier this month, CVE-2020-36193. The core update will patch the library to include this fix. This security release will correlate to Drupal security release SA-CORE-2021-001 issued on January 20th. 2021.

Because Backdrop issued its regularly scheduled minor release on January 15th, and based on the severity of these issues, the Backdrop Security Team has agreed to postpone this security release for one week.

The Backdrop CMS project uses the PEAR Archive_Tar library. The PEAR Archive_Tar library has released a security update that impacts Backdrop. For more information please see the CVE's linked here.

Multiple vulnerabilities are possible if Backdrop is configured to allow .tar, .tar.gz, .bz2 or .tlz file uploads and processes them.

To mitigate this issue, prevent untrusted users from uploading .tar, .tar.gz, .bz2 or .tlz files.

Backdrop core does not properly sanitize certain filenames on uploaded files. This can lead to files being interpreted as the incorrect extension and served as the wrong MIME type, or executed as PHP for certain hosting configurations.