Read the docs
TI-2026-19374 Aliases CVE-2026-24046GHSA-rq6q-wr2q-7pgp

Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

Priority LOW 32CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read arbitrary files via the `debug:log` action by creating a symlink pointing to sensitive files (e.g., `/etc/passwd`, configuration files, secrets); delete arbitrary files via the `fs:delete` action by creating symlinks pointing outside the workspace, and write files outside the workspace via archive extraction (tar/zip) containing malicious symlinks. This affects any Backstage deployment where users can create or execute Scaffolder templates. This vulnerability is fixed in `@backstage/backend-defaults` versions 0.12.2, 0.13.2, 0.14.1, and 0.15.0; `@backstage/plugin-scaffolder-backend` versions 2.2.2, 3.0.2, and 3.1.1; and `@backstage/plugin-scaffolder-node` versions 0.11.2 and 0.12.3. Users should upgrade to these versions or later. Some workarounds are available. Follow the recommendation in the Backstage Threat Model to limit access to creating and updating templates, restrict who can create and execute Scaffolder templates using the permissions framework, audit existing templates for symlink usage, and/or run Backstage in a containerized environment with limited filesystem access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00525 44th percentileScored 2026-11-07
Fix Fixed @backstage/backend-defaults (npm): 0.12.2, 0.13.2, 0.14.1@backstage/plugin-scaffolder-backend (npm): 2.2.2, 3.0.2, 3.1.1+1 more productRed Hat: 2 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstagebackstage@backstage/backend-defaults < 0.12.2; @backstage/backend-defaults >= 0.13.0, < 0.13.2; @backstage/backend-defaults >= 0.14.0, < 0.14.1; @backstage/plugin-scaffolder-backend < 2.2.2; @backstage/plugin-scaffolder-backend >= 3.0.0, < 3.0.2; @backstage/plugin-scaffolder-backend >= 3.1.0, < 3.1.1; @backstage/plugin-scaffolder-node < 0.11.2; @backstage/plugin-scaffolder-node >= 0.12.0, < 0.12.3—No fix listedCNA
—@backstage/backend-defaults (npm)before 0.12.20.12.2Patch availableGHSA-rq6q-wr2q-7pgp
—@backstage/backend-defaults (npm)0.13.0 to before 0.13.20.13.2Patch availableGHSA-rq6q-wr2q-7pgp
—@backstage/backend-defaults (npm)0.14.0 to before 0.14.10.14.1Patch availableGHSA-rq6q-wr2q-7pgp
—@backstage/plugin-scaffolder-backend (npm)before 2.2.22.2.2Patch availableGHSA-rq6q-wr2q-7pgp
—@backstage/plugin-scaffolder-backend (npm)3.0.0 to before 3.0.23.0.2Patch availableGHSA-rq6q-wr2q-7pgp
—@backstage/plugin-scaffolder-backend (npm)3.1.0 to before 3.1.13.1.1Patch availableGHSA-rq6q-wr2q-7pgp
—@backstage/plugin-scaffolder-node (npm)before 0.11.20.11.2Patch availableGHSA-rq6q-wr2q-7pgp
—@backstage/plugin-scaffolder-node (npm)0.12.0 to before 0.12.30.12.3Patch availableGHSA-rq6q-wr2q-7pgp
  • backstage Vendorbackstage Affected @backstage/backend-defaults < 0.12.2; @backstage/backend-defaults >= 0.13.0, < 0.13.2; @backstage/backend-defaults >= 0.14.0, < 0.14.1; @backstage/plugin-scaffolder-backend < 2.2.2; @backstage/plugin-scaffolder-backend >= 3.0.0, < 3.0.2; @backstage/plugin-scaffolder-backend >= 3.1.0, < 3.1.1; @backstage/plugin-scaffolder-node < 0.11.2; @backstage/plugin-scaffolder-node >= 0.12.0, < 0.12.3 Fixed in — No fix listed CNA
  • @backstage/backend-defaults (npm) Vendor— Affected before 0.12.2 Fixed in 0.12.2 Patch available GHSA-rq6q-wr2q-7pgp
  • @backstage/backend-defaults (npm) Vendor— Affected 0.13.0 to before 0.13.2 Fixed in 0.13.2 Patch available GHSA-rq6q-wr2q-7pgp
  • @backstage/backend-defaults (npm) Vendor— Affected 0.14.0 to before 0.14.1 Fixed in 0.14.1 Patch available GHSA-rq6q-wr2q-7pgp
  • @backstage/plugin-scaffolder-backend (npm) Vendor— Affected before 2.2.2 Fixed in 2.2.2 Patch available GHSA-rq6q-wr2q-7pgp
  • @backstage/plugin-scaffolder-backend (npm) Vendor— Affected 3.0.0 to before 3.0.2 Fixed in 3.0.2 Patch available GHSA-rq6q-wr2q-7pgp
  • @backstage/plugin-scaffolder-backend (npm) Vendor— Affected 3.1.0 to before 3.1.1 Fixed in 3.1.1 Patch available GHSA-rq6q-wr2q-7pgp
  • @backstage/plugin-scaffolder-node (npm) Vendor— Affected before 0.11.2 Fixed in 0.11.2 Patch available GHSA-rq6q-wr2q-7pgp
  • @backstage/plugin-scaffolder-node (npm) Vendor— Affected 0.12.0 to before 0.12.3 Fixed in 0.12.3 Patch available GHSA-rq6q-wr2q-7pgp

Remediation

  • Fix · GHSA-rq6q-wr2q-7pgp @backstage/backend-defaults (npm) Fixed in 0.12.2 Advisory →
  • Fix · GHSA-rq6q-wr2q-7pgp @backstage/backend-defaults (npm) Fixed in 0.13.2 Advisory →
  • Fix · GHSA-rq6q-wr2q-7pgp @backstage/backend-defaults (npm) Fixed in 0.14.1 Advisory →
  • Fix · GHSA-rq6q-wr2q-7pgp @backstage/plugin-scaffolder-backend (npm) Fixed in 2.2.2 Advisory →
  • Fix · GHSA-rq6q-wr2q-7pgp @backstage/plugin-scaffolder-backend (npm) Fixed in 3.0.2 Advisory →
  • Fix · GHSA-rq6q-wr2q-7pgp @backstage/plugin-scaffolder-backend (npm) Fixed in 3.1.1 Advisory →
  • Fix · GHSA-rq6q-wr2q-7pgp @backstage/plugin-scaffolder-node (npm) Fixed in 0.11.2 Advisory →
  • Fix · GHSA-rq6q-wr2q-7pgp @backstage/plugin-scaffolder-node (npm) Fixed in 0.12.3 Advisory →

Red Hat 2 advisories

  • RHSA-2026:6802 Released 2026-04-07 · Red Hat rating Important
    Red Hat Developer Hub 1.9.3 release.
    • Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:6174 Released 2026-03-30 · Red Hat rating Important
    Red Hat Developer Hub 1.8.5 release.
    • Red Hat Developer Hub 1.8 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Developer Hub 1.8Fixed RHSA-2026:6174
Red Hat Developer Hub 1.9Fixed RHSA-2026:6802
Not affected: 2 products
  • Red Hat Developer Hub 1.8
  • Red Hat Developer Hub 1.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-24046
  2. 2026-10-03 Alias added: GHSA-rq6q-wr2q-7pgp

References

Advisory 1

Other 3

  • TI-2026-33119 Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys KEVCVSS 3.1CRITICAL 9.6
  • TI-2018-10499 Integer overflow in backstage kernel KEVCVSS 3.0HIGH 7.8
  • TI-2024-08998 Remote Code Execution in kedro-org/kedro CVSS 3.0CRITICAL 9.8
  • TI-2023-12294 Dragonfly2 vulnerable to hard coded cyptographic key CVSS 3.1CRITICAL 9.8
  • TI-2021-12074 Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via… CVSS 3.1CRITICAL 9.8
  • TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
See all 662 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences