CVE-2026-24046: Backstage Scaffolder symlink path traversal in multiple actions

CVE-2026-24046 · Severity: high · CVSS 7.1 · Published 2026-01-21

Backstage, a platform used to build internal developer portals, contains a vulnerability in its Scaffolder component which automates software creation. An attacker with the ability to create or run templates could use specially crafted links (symlinks) to bypass security boundaries. This could allow them to read sensitive system files like passwords and secrets, delete important data, or write unauthorized files to the server, potentially leading to a full system compromise or data breach.

Technologies: Backstage Backend-Defaults, Backstage Plugin-Scaffolder-Backend, @backstage/backend-defaults (npm), @backstage/plugin-scaffolder-backend (npm), Red Hat Developer Hub. Vendors: Backstage, npm, Red Hat.

Quick answers

Is CVE-2026-24046 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-24046 being exploited in the wild.
How severe is CVE-2026-24046?
High severity, with a CVSS score of 7.1, published 21 January 2026.
Which products and versions are affected?
Backstage Backend-Defaults < 0.12.2, 0.13.0 - 0.13.2, 0.14.0 - 0.14.1; Backstage Plugin-Scaffolder-Backend < 2.2.2, 3.0.0 - 3.0.2, 3.1.0 - 3.1.1; Backstage Plugin-Scaffolder-Node < 0.11.2, 0.12.0 - 0.12.3; @backstage/backend-defaults (npm) SEMVER:introduced=0,fixed=0.12.2; and 3 more.
Is there a fix for CVE-2026-24046?
Yes. @backstage/backend-defaults (npm): upgrade to 0.12.2 or later; @backstage/plugin-scaffolder-backend (npm): upgrade to 2.2.2 or later; @backstage/plugin-scaffolder-node (npm): upgrade to 0.11.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-24046 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-24046?
Check whether you run Backstage Backend-Defaults, Backstage Plugin-Scaffolder-Backend, Backstage Plugin-Scaffolder-Node or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @backstage/backend-defaults (npm): upgrade to 0.12.2 or later
    npm install @backstage/backend-defaults@0.12.2
  • @backstage/plugin-scaffolder-backend (npm): upgrade to 2.2.2 or later
    npm install @backstage/plugin-scaffolder-backend@2.2.2
  • @backstage/plugin-scaffolder-node (npm): upgrade to 0.11.2 or later
    npm install @backstage/plugin-scaffolder-node@0.11.2

Technical details

A path traversal vulnerability exists in Backstage due to improper link resolution (CWE-59) and insufficient path neutralization (CWE-22) within Scaffolder actions and archive extraction utilities. An attacker with low-privileged network access to create or execute Scaffolder templates can use malicious symlinks to escape the workspace directory. Specifically, the 'debug:log' action can be abused to read arbitrary files (e.g., /etc/passwd), 'fs:delete' can be used to delete files outside the workspace, and tar/zip extraction can be used to write files to unauthorized locations. The fix involves implementing 'resolveSafeChildPath' to ensure all file operations remain within the designated sandbox.

Affected products

  • Backstage Backstage backend-defaults < 0.12.2, 0.13.0 - 0.13.2, 0.14.0 - 0.14.1
  • Backstage Backstage plugin-scaffolder-backend < 2.2.2, 3.0.0 - 3.0.2, 3.1.0 - 3.1.1
  • Backstage Backstage plugin-scaffolder-node < 0.11.2, 0.12.0 - 0.12.3
  • Red Hat Red Hat Developer Hub 1.8, 1.9

Identifiers

  • CVE-2026-24046
  • GHSA-rq6q-wr2q-7pgp

Timeline

  • 2026-01-20: patched: Fix committed to Backstage repository.
  • 2026-01-21: advisory: GitHub Security Advisory GHSA-rq6q-wr2q-7pgp published.
  • 2026-01-21: disclosed: CVE-2026-24046 published.
  • 2026-03-30: advisory: Red Hat issued security advisory RHSA-2026:6174 for Developer Hub.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.