CVE-2025-46595

Summary

CVE-2025-46595 is a Cross-Site Scripting (XSS) vulnerability affecting the Flag module in Backdrop CMS versions before 1.x-3.6.2. The Flag module, which allows flags to be added to various entities, does not properly verify flag links or responses from those links. An attacker who can create or edit comments or content with a filtered text format can exploit this vulnerability by injecting malicious HTML code, potentially leading to XSS attacks. Although the attacker needs to have a specific role to create links on the website, this issue poses a significant security risk if not addressed promptly.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.