TI-2021-17990 Aliases CVE-2021-41151 GHSA-pvv8-8fx9-h673

Path Traversal in @backstage/plugin-scaffolder-backend

LOW 33CWE-22Published 2021-10-18 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitive files from the environment where Scaffolder Tasks are run. The attack is executed by crafting a custom Scaffolder template with a `github:publish:pull-request` action and a particular source path. When the template is executed the sensitive files would be included in the published pull request. This vulnerability is mitigated by the fact that an attacker would need access to create and register templates in the Backstage catalog, and that the attack is very visible given that the exfiltration happens via a pull request. The vulnerability is patched in the `0.15.9` release of `@backstage/plugin-scaffolder-backend`.

Why it matters now

EPSS 0.01315 70th percentileScored 2026-11-07

Fix Fixed backstage (backstage): 0.15.9@backstage/plugin-scaffolder-backend (npm): 0.15.9

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
backstage	backstage	0.9.4 to before 0.15.9	0.15.9	Patch available	CNA
—	@backstage/plugin-scaffolder-backend (npm)	0.9.4 to before 0.15.9	0.15.9	Patch available	GHSA-pvv8-8fx9-h673

backstage Vendorbackstage Affected 0.9.4 to before 0.15.9 Fixed in 0.15.9 Patch available CNA
@backstage/plugin-scaffolder-backend (npm) Vendor— Affected 0.9.4 to before 0.15.9 Fixed in 0.15.9 Patch available GHSA-pvv8-8fx9-h673

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:linuxfoundation:backstage::::::::	0.9.4 to before 0.15.9	Vulnerable	backstage

cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:* Versions 0.9.4 to before 0.15.9 Vulnerable ·backstage

Remediation

Fix · CNA backstage (backstage) Fixed in 0.15.9
Fix · GHSA-pvv8-8fx9-h673 @backstage/plugin-scaffolder-backend (npm) Fixed in 0.15.9 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-41151
2026-10-03 Alias added: GHSA-pvv8-8fx9-h673

References

Patch 1

https://github.com/backstage/backstage/commit/6968962c920508eae19a4c1c200fa2c8980a4006

Advisory 2

Other 2

TI-2023-17988 Insecure sandbox in Backstage Scaffolder plugin CVSS 3.1CRITICAL 9.9
TI-2026-69075 Sensitive information exposure in Backstage Scaffolder CVSS 3.1CRITICAL 9.6
TI-2026-69061 Path traversal in Backstage Bitbucket pull-request scaffolder actions CVSS 3.1CRITICAL 9.9
TI-2026-60083 Backstage: Improper input validation in TechDocs MkDocs configuration CVSS 3.1HIGH 8.8
TI-2026-69165 Backstage TechDocs config flaw allows code execution CVSS 3.1HIGH 8.8
TI-2026-69083 Code injection via MkDocs theme configuration in Backstage TechDocs CVSS 3.1HIGH 8.8

See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences