CVE-2025-25062 Cross-site scripting in backdrop
Attackers can execute arbitrary JavaScript in an administrator's browser via crafted content in CKEditor 5, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-25062?
CVE-2025-25062 is a medium-severity cross-site scripting vulnerability in backdropcms backdrop, published on 3 Feb 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor 5 rich text editor is used. This allows a potential attacker to craft specialized HTML and JavaScript that may be executed when an administrator attempts to edit a piece of content. This vulnerability is mitigated by the fact that an attacker must have the ability to create long text content (such as through the node or comment forms) and an administrator must edit (not view) the content that contains the malicious content. This problem only exists when using the CKEditor 5 module.
Weakness: CWE-79
Which versions are affected by CVE-2025-25062?
It affects 1 product.
Products include Backdropcms Backdrop Cms.
How do I fix CVE-2025-25062?
No fix has been published for CVE-2025-25062 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-25062 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-25062 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in backdropcms backdrop
Sources
Also known as GHSA-vrh8-g8q9-jhc6.