Path Traversal Vulnerability in Backstage Framework by Spotify
CVE-2026-24046
What is CVE-2026-24046?
The Backstage framework, developed by Spotify, has been identified with a vulnerability that allows attackers to exploit symlink-based path traversal through various Scaffolder actions. This situation arises when users are able to create and execute Scaffolder templates, granting potential unauthorized access to sensitive files, including system configuration and credential files. Malicious actions can result in reading arbitrary files via the debug:log action, deleting files using the fs:delete action, and writing files outside the designated workspace during archive extraction. To mitigate this vulnerability, users should upgrade to the specified secure versions and apply recommended practices to restrict user permissions around Scaffolder template management.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
backstage @backstage/backend-defaults < 0.12.2 < @backstage/backend-defaults 0.12.2
backstage @backstage/backend-defaults >= 0.13.0, < 0.13.2 < @backstage/backend-defaults 0.13.0, 0.13.2
backstage @backstage/backend-defaults >= 0.14.0, < 0.14.1 < @backstage/backend-defaults 0.14.0, 0.14.1
References
CVSS V3.1
Timeline
Vulnerability published
Vulnerability Reserved