What is GHSA-ffpg-gm3h-4p5p?

GHSA-ffpg-gm3h-4p5p is a security advisory published by GitHub Security Advisories with Medium severity. Backdrop CMS Host Header Injection vulnerability

Which CVE IDs does GHSA-ffpg-gm3h-4p5p cover?

GHSA-ffpg-gm3h-4p5p covers the following CVE IDs: CVE-2025-63828. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-ffpg-gm3h-4p5p?

GHSA-ffpg-gm3h-4p5p affects 1 product, including: composer/backdrop/backdrop:\u003c= 1.32.0.

GHSA-ffpg-gm3h-4p5pMedium

Backdrop CMS Host Header Injection vulnerability

Vendor

GitHub Security Advisories

Published

November 18, 2025

Last Modified

November 19, 2025

🔗 CVE IDs covered (1)

CVE-2025-63828 →

📋 Description

Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection.

🎯 Affected products1

composer/backdrop/backdrop:<= 1.32.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-63828
https://github.com/mertdurum06/BackdropCms-1.32.1
https://github.com/mertdurum06/BackdropCms-1.32.1/blob/main/backdropcms_exploit.txt
https://github.com/advisories/GHSA-ffpg-gm3h-4p5p