CVE-2025-25063 Cross-site scripting in backdrop
An attacker can execute arbitrary scripts in a victim's browser by uploading a crafted SVG image and tricking them into viewing it directly.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-25063?
CVE-2025-25063 is a medium-severity cross-site scripting vulnerability in backdropcms backdrop, published on 3 Feb 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG images to ensure they do not contain potentially dangerous SVG tags. SVG images can contain clickable links and executable scripting, and using a crafted SVG, it is possible to execute scripting in the browser when an SVG image is viewed. This issue is mitigated by the attacker needing to be able to upload SVG images, and that Backdrop embeds all uploaded SVG images within <img> tags, which prevents scripting from executing. The SVG must be viewed directly by its URL in order to run any embedded scripting.
Weakness: CWE-79
Which versions are affected by CVE-2025-25063?
It affects 1 product.
Products include Backdropcms Backdrop Cms.
How do I fix CVE-2025-25063?
No fix has been published for CVE-2025-25063 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-25063 being exploited?
There is no known exploitation of CVE-2025-25063 in the wild and no public exploit code.
Other vulnerabilities in backdropcms backdrop
Sources
Also known as GHSA-cfr9-prm9-crgr.