CVE-2026-24046

Vulnerability overview

Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read arbitrary files via the `debug:log` action by creating a symlink pointing to sensitive files (e.g., `/etc/passwd`, configuration files, secrets); delete arbitrary files via the `fs:delete` action by creating symlinks pointing outside the workspace, and write files outside the workspace via archive extraction (tar/zip...

Affected product and versions

Product

backstage backstage, Red Hat Developer Hub 1.8, Red Hat Developer Hub 1.9

Affected versions

>= @backstage/backend-defaults < 0.12.2, >= @backstage/backend-defaults >= 0.13.0, < 0.13.2, >= @backstage/backend-defaults >= 0.14.0, < 0.14.1, >= @backstage/plugin-scaffolder-backend < 2.2.2, >= @backstage/plugin-scaffolder-backend >= 3.0.0, < 3.0.2, >= @backstage/plugin-scaffolder-backend >= 3.1.0, < 3.1.1, >= @backstage/plugin-scaffolder-node < 0.11.2, >= @backstage/plugin-scaffolder-node >= 0.12.0, < 0.12.3

Fixed versions

No verified fixed-version field is available yet

Technical data

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L

CWE

CWE-22, CWE-59