GitHub Advisoryadvisory · Packagist

GHSA-ffpg-gm3h-4p5p Backdrop CMS Host Header Injection vulnerability

MEDIUM Published 2025-11-18 Modified 2025-11-19 Official page ↗
Aliases
CVE-2025-63828
Ecosystem
Packagist
Packages
backdrop/backdrop
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P
Weaknesses
CWE-601, CWE-644
Reviewed
2025-11-18

Affected packages

• Packagist backdrop/backdrop: <= 1.32.0 (no fix yet)

Description

Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection.

Related

Alias · CVE (1)

  • CVE-2025-63828 Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests,… vulnerability

Weakness · CWE (2)

  • CWE-601 URL Redirection to Untrusted Site weakness
  • CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax weakness

References