CVE-2026-106494

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper input validation in cloud storage url readers. An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection. This issue is fixed in version 0.17.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106494

EUVD

EUVD-2026-94015

Affected Vendors & Products

Vendor	Product	Version / Range
backstage	backstage	< 1.54.6
@backstage	backend-defaults	< 0.17.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

Backstage before version 0.17.8 has a flaw in the @backstage/backend-defaults package where cloud storage URLs are not properly validated. An attacker with write access to a cloud storage bucket could create object names that match protected files in the output directory. This could allow content injection in certain deployment setups.

Detection Guidance

To detect this vulnerability, check the version of the @backstage/backend-defaults package. If it is below 0.17.8, the system is vulnerable. Run: npm list @backstage/backend-defaults or check package.json for the version.

Impact Analysis

If exploited, this vulnerability could let an attacker inject malicious content into your Backstage instance. This might lead to unauthorized access, data leaks, or system compromise depending on your deployment configuration.

Compliance Impact

This vulnerability could potentially violate compliance requirements like GDPR or HIPAA by enabling unauthorized data access or modification. Organizations must ensure proper mitigation to maintain regulatory adherence.

Mitigation Strategies

Upgrade the @backstage/backend-defaults package to version 0.17.8 or later to address the improper input validation issue in cloud storage url readers.

Hi! I’m here to help you understand CVE-2026-106494. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70