CVE-2026-24046: Symlink Path Traversal Vulnerability in Backstage Scaffolder Actions
Summary
CVE-2026-24046: Backstage has a Possible Symlink Path Traversal in Scaffolder Actions. Affects @backstage/backend-defaults across 3 version ranges.
< 0.12.2
>= 0.13.0, < 0.13.2
>= 0.14.0, < 0.14.1
Fixed in 0.12.2, 0.13.2 or 0.14.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Backstage is an open-source platform designed to streamline the development process by providing a centralized service catalog and developer tools. It allows users to create and manage Scaffolder templates, which automate the setup of new projects and services. However, the platform has been found to have vulnerabilities in its Scaffolder actions that can be exploited through symlink-based path traversal attacks.
Vulnerability Detail
The vulnerability arises from multiple Scaffolder actions and archive extraction utilities that are susceptible to symlink-based path traversal attacks. An attacker with the ability to create and execute Scaffolder templates can exploit this vulnerability to read sensitive files, delete arbitrary files, or write files outside the designated workspace. This poses a significant risk to any Backstage deployment where users have the capability to create or execute Scaffolder templates.
How To Fix
Latest published version: 0.18.1 as of 22 Oct 2026
npm install @backstage/backend-defaults@0.18.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.12.20.12.2npm install @backstage/backend-defaults@0.12.2 -
>= 0.13.0, < 0.13.20.13.2npm install @backstage/backend-defaults@0.13.2 -
>= 0.14.0, < 0.14.10.14.1npm install @backstage/backend-defaults@0.14.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
To mitigate the risk while waiting for the patch, consider implementing the following workarounds:
- Limit access to creating and updating templates as per the Backstage Threat Model.
- Restrict permissions for users who can create and execute Scaffolder templates.
- Audit existing templates for symlink usage.
- Run Backstage in a containerized environment with limited filesystem access.
Conclusion
In summary, CVE-2026-24046 is a significant vulnerability in Backstage that allows for potential exploitation through symlink path traversal. Users are strongly advised to upgrade to the patched versions of the affected packages and implement recommended workarounds to mitigate risks.
See every vulnerability recorded for @backstage/backend-defaults →
FAQ
CVE-2026-24046 is a vulnerability in Backstage that allows for symlink-based path traversal attacks through its Scaffolder actions.
If exploited, this vulnerability can allow attackers to read sensitive files, delete files, or write files outside the intended workspace, potentially compromising your system.
The patched versions are '@backstage/backend-defaults' 0.12.2 or later, '@backstage/plugin-scaffolder-backend' 2.2.2 or later, and '@backstage/plugin-scaffolder-node' 0.11.2 or later.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without needing to sign up.
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @backstage/backend-defaults.
