Security Advisories

Backdrop core's sanitization API fails to properly filter cross-site scripting under certain circumstances. 

Not all sites and users are affected, but configuration changes to prevent the exploit might be impractical and will vary between sites. Therefore, we recommend all sites update to this release as soon as possible.

The Backdrop project uses the pear Archive_Tar library, which has released a security update that impacts Backdrop. For more information please see:

• CVE-2020-36193

Exploits may be possible if Backdrop is configured to allow .tar, .tar.gz, .bz2, or .tlz file uploads and processes them, or if the Installer module is enabled.

There will be a security release of Backdrop 1.18.x, and 1.17.x on January 27th, 2021 between 19:00 - 23:00 UTC. Security release announcements will appear here, on the Backdrop security page. This release will not require a database update.

The PEAR Archive_Tar library included with Backdrop core released a security update earlier this month, CVE-2020-36193. The core update will patch the library to include this fix. This security release will correlate to Drupal security release SA-CORE-2021-001 issued on January 20th. 2021.

Because Backdrop issued its regularly scheduled minor release on January 15th, and based on the severity of these issues, the Backdrop Security Team has agreed to postpone this security release for one week.

The Backdrop CMS project uses the PEAR Archive_Tar library. The PEAR Archive_Tar library has released a security update that impacts Backdrop. For more information please see the CVE's linked here.

Multiple vulnerabilities are possible if Backdrop is configured to allow .tar, .tar.gz, .bz2 or .tlz file uploads and processes them.

To mitigate this issue, prevent untrusted users from uploading .tar, .tar.gz, .bz2 or .tlz files.

Backdrop core does not properly sanitize certain filenames on uploaded files. This can lead to files being interpreted as the incorrect extension and served as the wrong MIME type, or executed as PHP for certain hosting configurations.

Backdrop core's built-in CKEditor image caption functionality is vulnerable to XSS.

This SA is equivalent to Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2020-010

The Backdrop AJAX API does not disable JSONP by default, which can lead to cross-site scripting.

This SA is equivalent to Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2020-007

There will be a security release of Backdrop 1.17.x, and 1.16.x on Sept 30th, 2020 between 19:00 - 23:00 UTC. Security release announcements will appear here, on the Backdrop security page.  This release will not require a database update.

This security release will be a complimentary release to the Drupal security releases SA-CORE-2020-007 and SA-CORE-2020-010 issued on September 16th.

Because Backdrop issued its regularly scheduled minor release on September 15th, and based on the severity of these issues, the Backdrop Security Team has agreed to postpone this security release for two weeks. 

The Backdrop core Form API does not properly handle form input from cross-site requests, which can lead to other vulnerabilities.

This module provides a standardized solution for building API's so that external clients can communicate with Backdrop.

The module's taxonomy term index resource doesn't take into consideration certain access control tags provided (but unused) by core, that certain contrib modules depend on.

This vulnerability is mitigated by the fact your site must have the taxonomy term index resource enabled, your site must have a contributed module enabled which utilizes taxonomy term access control, and an attacker must know your API endpoint's path.