CVE-2025-25062

MEDIUMNuclei

Backdrop CMS - Cross-Site Scripting

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-25062 has a selected CVSS score of 4.4 (medium); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor 5 rich text editor is used. This allows a potential attacker to craft specialized HTML and JavaScript that may be executed when an administrator attempts to edit a piece of content. This vulnerability is mitigated by the fact that an attacker must have the ability to create long text content (such as through the node or comment forms) and an administrator must edit (not view) the content that contains the malicious content. This problem only exists when using the CKEditor 5 module.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 9, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

backdrop

Browse backdropcms / backdrop

Default status: unknown

CVE List1.28.0 to < 1.28.5affected
1.29.0 to < 1.29.3affected

Proofs of concept

1

Repository PoCs

GitHubrhburt/CVE-2025-25062Repository PoCby rhburt2Not analyzed5 files

12.6 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMBackdrop CMS - Cross-Site ScriptingCVSS 4.4

An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor 5 rich text editor is used. This allows a potential attacker to craft specialized HTML and JavaScript that may be executed when an administrator attempts to edit a piece of content. This vulnerability is mitigated by the fact that an attacker must have the ability to create long text content (such as through the node or comment forms) and an administrator must edit (not view) the content that contains the malicious content. This problem only exists when using the CKEditor 5 module.

Impact

Authenticated attackers with content creation permissions can craft malicious HTML and JavaScript in long text fields that executes when administrators edit the content through CKEditor 5, potentially stealing admin session cookies, credentials, or escalating privileges.

Remediation

Update Backdrop CMS to version 1.28.5 or 1.29.3 or later that properly isolates long text content in CKEditor 5.

WeaknessesCWE-79
Authorssoonghee2
Template tagscvecve2025xssstoredbackdropheadlessvuln
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:*
Shodan: Backdrop CMS
https://github.com/XiaomingX/data-cve-poc/tree/main/2025/CVE-2025-25062 https://nvd.nist.gov/vuln/detail/CVE-2025-25062 https://www.tenable.com/cve/CVE-2025-25062/cpes https://feedly.com/cve/CVE-2025-25062

Source: ProjectDiscovery

References

4