TI-2021-19590 Aliases CVE-2021-43783 GHSA-mg3m-f475-28hv

Path Traversal in @backstage/plugin-scaffolder-backend

LOW 39CWE-22Published 2021-11-29 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. In affected versions a malicious actor with write access to a registered scaffolder template is able to manipulate the template in a way that writes files to arbitrary paths on the scaffolder-backend host instance. This vulnerability can in some situation also be exploited through user input when executing a template, meaning you do not need write access to the templates. This method will not allow the attacker to control the contents of the injected file however, unless the template is also crafted in a specific way that gives control of the file contents. This vulnerability is fixed in version `0.15.14` of the `@backstage/plugin-scaffolder-backend`. This attack is mitigated by restricting access and requiring reviews when registering or modifying scaffolder templates.

Why it matters now

EPSS 0.01246 69th percentileScored 2026-11-07

Fix Fixed backstage (backstage): 0.15.14@backstage/plugin-scaffolder-backend (npm): 0.15.14

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
backstage	backstage	before 0.15.14	0.15.14	Patch available	CNA
—	@backstage/plugin-scaffolder-backend (npm)	before 0.15.14	0.15.14	Patch available	GHSA-mg3m-f475-28hv

backstage Vendorbackstage Affected before 0.15.14 Fixed in 0.15.14 Patch available CNA
@backstage/plugin-scaffolder-backend (npm) Vendor— Affected before 0.15.14 Fixed in 0.15.14 Patch available GHSA-mg3m-f475-28hv

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:linuxfoundation:backstage::::::::	before 0.15.14	Vulnerable	backstage

cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:* Versions before 0.15.14 Vulnerable ·backstage

Remediation

Fix · CNA backstage (backstage) Fixed in 0.15.14
Fix · GHSA-mg3m-f475-28hv @backstage/plugin-scaffolder-backend (npm) Fixed in 0.15.14 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-43783
2026-10-03 Alias added: GHSA-mg3m-f475-28hv

References

Patch 1

https://github.com/backstage/backstage/commit/f9352ab606367cd9efc6ff048915c70ed3013b7f

Advisory 2

Other 1

https://github.com/backstage/backstage

TI-2023-17988 Insecure sandbox in Backstage Scaffolder plugin CVSS 3.1CRITICAL 9.9
TI-2026-69075 Sensitive information exposure in Backstage Scaffolder CVSS 3.1CRITICAL 9.6
TI-2026-69061 Path traversal in Backstage Bitbucket pull-request scaffolder actions CVSS 3.1CRITICAL 9.9
TI-2026-60083 Backstage: Improper input validation in TechDocs MkDocs configuration CVSS 3.1HIGH 8.8
TI-2026-69165 Backstage TechDocs config flaw allows code execution CVSS 3.1HIGH 8.8
TI-2026-69083 Code injection via MkDocs theme configuration in Backstage TechDocs CVSS 3.1HIGH 8.8

See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences