Advisory ID: 
Access bypass
Versions affected: 
  • Backdrop Core 1.x.x versions prior to 1.7.1

Files uploaded by anonymous users into a private file system can be accessed by other anonymous users - access bypass - Moderately Critical

Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Backdrop core did not previously provide this protection, allowing an access bypass vulnerability to occur. This issue is mitigated by the fact that in order to be affected, the site must allow anonymous users to upload files into a private file system.

The Drupal security team has also received reports that this vulnerability is being exploited for spam purposes, similar to the scenario discussed in PSA-2016-003 for the public file system.


Upgrade your site to the latest version of Backdrop CMS. Download available at Backdrop CMS 1.7.1 release page. Update instructions are available at

Reported By: 
Fixed By: