[backend] fix escaping of cpe id