Date: 
Wednesday, Apr 23rd, 2025
Advisory ID: 
BACKDROP-SA-CONTRIB-2025-012
Security risk: 
Moderately Critical
Vulnerability: 
Cross Site Scripting
CVE ID: 
CVE-2025-3900
Versions affected: 
  • Colorbox all versions prior to 1.x-2.17.3
Description: 

Colorbox is a module that allows Images, and iframed or inline content to be displayed in a modal above the current page.

The Colorbox module doesn't sufficiently sanitize data attributes before opening modals.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes.

 

Solution: 

Upgrade your site to the most recent version of Colorbox module. Download available on the Colorbox releases page.

Reported By: 
Fixed By: 

Security email list

Backdrop maintains a security mailing list. Whenever a security release comes out, an email will be sent to everyone subscribed to that list, announcing the new release. Please follow the steps below to join the Security email list.

  1. Log in to backdropcms.org
  2. Edit your profile
  3. Switch to the "Subscriptions" tab
  4. Check the box labeled "Security updates"
  5. Save the form