CVE-2022-42094

Deeper analysis

Backdrop CMS version 1.23.0 contains a stored cross-site scripting vulnerability that resides in the Card content component and is tracked as CVE-2022-42094. The flaw is classified under CWE-79 and carries a CVSS 3.1 score of 4.8, reflecting network attack vector, low complexity, high privileges required, and user-interaction dependencies that result in limited confidentiality and integrity impact with changed scope.

An authenticated administrator can insert a crafted payload into a Card that is later rendered for other users; when a victim views the affected content the script executes in the browser, enabling actions such as session token theft or unauthorized interface manipulation. Exploitation therefore requires an account with sufficient privileges to create or edit Cards and depends on a subsequent victim interaction.

The EPSS score rose from lower values to a peak of 0.3803 on 2026-01-13 before receding to the current 0.1249, indicating a period of increased exploitation interest after disclosure. Public references include the Backdrop CMS project site, the 1.23.0 release tag, and a proof-of-concept repository that document the affected component and provide reproduction details for practitioners evaluating patch or configuration changes.