CVE-2026-24046

The Backstage framework is vulnerable to symlink-based path traversal attacks in multiple Scaffolder actions and archive extraction utilities . An attacker with permissions to create and execute Scaffolder templates can exploit these vulnerabilities to read arbitrary files (e.g., /etc/passwd, sec...