Path Traversal Vulnerability in Backstage Framework by Spotify
CVE-2026-24046
What is CVE-2026-24046?
The Backstage framework, developed by Spotify, has been identified with a vulnerability that allows attackers to exploit symlink-based path traversal through various Scaffolder actions. This situation arises when users are able to create and execute Scaffolder templates, granting potential unauthorized access to sensitive files, including system configuration and credential files. Malicious actions can result in reading arbitrary files via the debug:log action, deleting files using the fs:delete action, and writing files outside the designated workspace during archive extraction. To mitigate this vulnerability, users should upgrade to the specified secure versions and apply recommended practices to restrict user permissions around Scaffolder template management.
Affected Version(s)
backstage @backstage/backend-defaults < 0.12.2 < @backstage/backend-defaults 0.12.2
backstage @backstage/backend-defaults >= 0.13.0, < 0.13.2 < @backstage/backend-defaults 0.13.0, 0.13.2
backstage @backstage/backend-defaults >= 0.14.0, < 0.14.1 < @backstage/backend-defaults 0.14.0, 0.14.1