CVE-2026-24046
Symlink Path Traversal in Backstage Scaffolder Enables File Access
Publication date: 2026-01-21
Last updated on: 2026-01-21
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| backstage | backend_defaults | 0.12.2 |
| backstage | backend_defaults | 0.13.2 |
| backstage | backend_defaults | 0.14.1 |
| backstage | backend_defaults | 0.15.0 |
| backstage | plugin_scaffolder_backend | 2.2.2 |
| backstage | plugin_scaffolder_backend | 3.0.2 |
| backstage | plugin_scaffolder_backend | 3.1.1 |
| backstage | plugin_scaffolder_node | 0.11.2 |
| backstage | plugin_scaffolder_node | 0.12.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
| CWE-59 | The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Backstage, an open framework for building developer portals. It involves multiple Scaffolder actions and archive extraction utilities that are vulnerable to symlink-based path traversal attacks. An attacker who can create and execute Scaffolder templates can exploit symbolic links to read arbitrary files (such as sensitive system files), delete arbitrary files outside the intended workspace, and write files outside the workspace by using malicious archives containing symlinks. This allows unauthorized access and modification of files beyond the intended scope.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows attackers to read, delete, or write arbitrary files, including sensitive files and secrets, which could lead to unauthorized access or data breaches. Such incidents can compromise the confidentiality and integrity of personal or sensitive data, potentially causing non-compliance with standards and regulations like GDPR and HIPAA that require protection of sensitive information. Therefore, if exploited, this vulnerability could negatively impact compliance with these regulations.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized reading of sensitive files (like /etc/passwd, configuration files, and secrets), deletion of arbitrary files outside the workspace, and writing files outside the workspace. This can compromise system integrity, confidentiality, and availability by exposing sensitive information and allowing attackers to manipulate or destroy files on the system where Backstage is deployed.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade to the fixed versions of the affected Backstage packages: @backstage/backend-defaults versions 0.12.2, 0.13.2, 0.14.1, or 0.15.0; @backstage/plugin-scaffolder-backend versions 2.2.2, 3.0.2, or 3.1.1; and @backstage/plugin-scaffolder-node versions 0.11.2 or 0.12.3 or later. Additionally, limit access to creating and updating Scaffolder templates by using the permissions framework, audit existing templates for symlink usage, and consider running Backstage in a containerized environment with restricted filesystem access.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves auditing existing Scaffolder templates for symlink usage and monitoring for suspicious file operations related to symlinks. Since the vulnerability involves symlink-based path traversal via Scaffolder actions and archive extraction, you can check for symlinks in template directories and extracted archives. For example, use commands like `find /path/to/scaffolder/templates -type l` to find symlinks in templates. Additionally, monitor logs for unusual access to sensitive files or unexpected file deletions. There are no specific commands provided for network detection in the context, but restricting and auditing template creation and execution is recommended.