Package Instance

Backstage has a Possible Symlink Path Traversal in Scaffolder Actions
Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to:

1. **Read arbitrary files** via the `debug:log` action by creating a symlink pointing to sensitive files (e.g., `/etc/passwd`, configuration files, secrets)
2. **Delete arbitrary files** via the `fs:delete` action by creating symlinks pointing outside the workspace
3. **Write files outside the workspace** via archive extraction (tar/zip) containing malicious symlinks

This affects any Backstage deployment where users can create or execute Scaffolder templates.