May I know if backdrop vulnerable to the Log4shell/Log4j (CVE-2021-44228) in any stage or version or third party plugin found vulnerable to this ? Is there any official statement from backdrop on this ? I need a firm answer on this. Thanks.
Backdrop LIVE
October 22nd-24th, 2026
An interactive online event for anyone interested in Backdrop CMS. Everyone is welcome.
Weekly office hours
Bring your questions to our weekly virtual office hours, every Wednesday. Everyone is welcome.
Recent topics
Posted 4 days 22 hours ago by Martin Price | System Horizons Ltd (yorkshirepudding) in Meet-Ups and Events
Posted 1 week 3 days ago by (ian) in How-To and Troubleshooting
Posted 1 week 3 days ago by (clarkac) in How-To and Troubleshooting
Posted 2 weeks 1 day ago by Erik Wesselius (zilvervos) in Other
Posted 2 weeks 3 days ago by (Chrys) in How-To and Troubleshooting
Recent comments
Trying to push it to upstream 🤞 https://github.com/drush-ops/drush/pull/6621
Using Drush 8 with php 8
Hi folks, I went ahead and ported all drush 8.x stuff to PHP 8.3 and completely ripped out the legacy Symfony 2 internals. You can check out the exact details of what was done in the PR...
Using Drush 8 with php 8
The inability to check for and install updates makes website development and maintenance extremely difficult. Managing over ten websites across two different hosting providers—one of which is...
Unable to run update - fails with Connection timed out
Thanks for the response, Herb! Since I posted that I did some more testing and have posted this issue https://github.com/backdrop-contrib/tfa_basic/issues/33 In fact, if both email...
Comments
Backdrop is definitely not vulnerable because of Log4j. Log4j is a Java component; Backdrop doesn't directly use Java, it's written in PHP, HTML, and JavaScript, with a smattering of scripting languages and configurations.
Note: I don't speak officially for Backdrop, but I'm pretty confident about this.
I'm glad to hear this. Thanks for your affirmation.