CVE-2026-24046 Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read arbitrary files vi...

CVE-2026-24046 Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read arbitrary files vi...

CVE-2026-24046

Backstage CVE-2026-24046 describes a symlink-based path traversal in multiple Scaffolder actions and archive extraction utilities. The vulnerability can allow reading arbitrary files (via debug:log), deleting files outside the workspace (via fs:delete), and writing outside the workspace during ar...

CVE-2026-24046 Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read arbitrary files vi...

@accounter/server (>=0.0.0 <=0.0.3-alpha-20241114141215-09b7d417e7e139562b2a77a6eb2d990da536e1ec), @frontside/backstage-plugin-graphql (>=0.1.0 <=0.6.0) +4 more potentially affected by unknown CVE via @envelop/graphql-modules (>=0.2.1 <=6.0.0)

@envelop/graphql-modules NPM version =0.2.1, =0.0.0, =0.1.0, =0.1.7, =0.2.6, =0.1.0, =0.7.0, =0.9.6 Source cves: unknown CVE Source advisory: OSV:GHSA-H3HW-29FV-2X75...

Backstage security vulnerabilities

Backstage is an open-source application developed by Backstage. It serves as an open platform for building developer portals. Backstage has a security vulnerability that stems from the resolveSafeChildPath utility function not properly verifying symbolic link chains and floating symbolic links,...

Backstage Code Issues and Vulnerabilities

Backstage is an open-source application developed by Backstage. It serves as an open platform for building developer portals. Versions of Backstage prior to 0.12.2, 0.13.2, 0.14.1, and 0.15.0 contained code vulnerabilities. These vulnerabilities stemmed from the FetchUrlReader component’s automat...

PT-2026-3880

Backstage is an open framework for building developer portals, and @backstage/backend-defaults provides the default implementations and setup for a standard Backstage backend app. Prior to versions 0.12.2, 0.13.2, 0.14.1, and 0.15.0, the FetchUrlReader component, used by the catalog and other...

Backstage Backlink Vulnerability

Backstage is an open-source application developed by Backstage. It serves as an open platform for building developer portals. Backstage has a postback link vulnerability, which stems from multiple Scaffolder operations and archive extraction tools being susceptible to path traversal attacks based...

PT-2026-3875

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.12.2, 0.13.2, 0.14.1, and 0.15.0 @backstage/plugin-scaffolder-backend versions prior to 2.2.2, 3.0.2, and 3.1.1 @backstage/plugin-scaffolder-node versions prior to 0.11.2 and 0.12.3 Description The software is...

PT-2026-3876

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.1.17 Description The resolveSafeChildPath utility function in @backstage/backend-plugin-api did not properly validate symlink chains and dangling symlinks, leading to a path traversal issue. An attacker could bypa...

Important: Red Hat Security Advisory: Red Hat Developer Hub 1.8.2 release.

Red Hat Developer Hub 1.8.2 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...

@jamietanna/renovate-graph (=0.30.0), @secustor/backstage-plugin-renovate-backend-module-runtime-direct (>=0.5.3 <=1.0.1) potentially affected by unknown CVE via renovate (>=39.60.0 <=40.21.2)

renovate NPM version =39.60.0, =0.5.3, =1.0.1 Source cves: unknown CVE Source advisory: OSV:GHSA-XJR7-3C3G-M763...

@cenk1cenk2/renovate-config (>=2.3.132 <=2.3.148), @jamietanna/patch-testing (>=0.1.0 <=0.2.28) +7 more potentially affected by unknown CVE via renovate (>=36.109.4 <=40.21.2)

renovate NPM version =36.109.4, =2.3.132, =0.1.0, =0.14.0, =0.5.0, =0.1.0, =0.1.0, =0.0.1, =0.19.0 - @zotero-chinese/renovate-config =1.0.3 Source cves: unknown CVE Source advisory: OSV:GHSA-FR4J-65PV-GJJJ...

@jamietanna/renovate-graph (>=0.24.0 <=0.30.0), @secustor/backstage-plugin-renovate-backend-module-runtime-direct (>=0.5.1 <=1.0.1) potentially affected by unknown CVE via renovate (>=39.22.0 <=40.21.2)

renovate NPM version =39.22.0, =0.24.0, =0.5.1, =1.0.1 Source cves: unknown CVE Source advisory: SNYK:JS-RENOVATE-14927387...

CVE-2021-41151

Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitive files from the environment where Scaffolder Tasks are run. The attack is executed by crafting a custom Scaffolder template with a github:publish:pull-request action and a...

Malicious Package

Overview backstage-plugin-glean is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

EUVD-2025-205460

Malicious code in backstage-plugin-glean npm...

Malicious code in backstage-plugin-glean (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 824531546cd7527be37fc4aa5ca2020424a1ecf090eaba3a8974105871c0931f The package backstage-plugin-glean was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192944 Malicious code in backstage-plugin-glean (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 824531546cd7527be37fc4aa5ca2020424a1ecf090eaba3a8974105871c0931f The package backstage-plugin-glean was found to contain malicious code. Source: ghsa-malware...