CVE-2024-54123: Backdropcms Backdrop CMS

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed for a text format.

Affected products

• Backdropcms Backdrop CMS: before 1.28.4 (fixed in 1.28.4); from 1.29.0, before 1.29.2 (fixed in 1.29.2)

Published 2024-11-29. Last modified 2026-06-17.