GHSA-ffpg-gm3h-4p5p

Backdrop CMS Host Header Injection vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-63828

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	backdrop/backdrop	<= 1.32.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-63828 advisory
https://github.com/backdrop/backdrop package
https://github.com/mertdurum06/BackdropCms-1.32.1 web
https://github.com/mertdurum06/BackdropCms-1.32.1/blob/main/backdropcms_exploit.txt web