- Backdrop Core 1.17.x versions prior to 1.17.4
- Backdrop Core 1.16.x versions prior to 1.16.6
Backdrop versions 1.15 and prior do not receive security coverage.
The Backdrop CMS project uses the PEAR Archive_Tar library. The PEAR Archive_Tar library has released a security update that impacts Backdrop. For more information please see the CVE's linked here.
Multiple vulnerabilities are possible if Backdrop is configured to allow .tar, .tar.gz, .bz2 or .tlz file uploads and processes them.
To mitigate this issue, prevent untrusted users from uploading .tar, .tar.gz, .bz2 or .tlz files.