CVE-2026-24046

creationtimestamp| type| source ---|---|--- 2026-01-22 01:24:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcxzn3eq6d2c 2026-01-24 21:22:58+00:00| seen| https://gist.github.com/alon710/95646488f16d926a9285cc4a529b9663 2026-01-24 22:19:14+00:00| seen|...

CVE-2026-24046

Backstage CVE-2026-24046 describes a symlink-based path traversal in multiple Scaffolder actions and archive extraction utilities. The vulnerability can allow reading arbitrary files (via debug:log), deleting files outside the workspace (via fs:delete), and writing outside the workspace during ar...