Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-t9gj-dq52-a3a3
Vulnerability ID VCID-t9gj-dq52-a3a3
Aliases CVE-2026-24046
GHSA-rq6q-wr2q-7pgp
Summary Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read arbitrary files via the `debug:log` action by creating a symlink pointing to sensitive files (e.g., `/etc/passwd`, configuration files, secrets); delete arbitrary files via the `fs:delete` action by creating symlinks pointing outside the workspace, and write files outside the workspace via archive extraction (tar/zip) containing malicious symlinks. This affects any Backstage deployment where users can create or execute Scaffolder templates. This vulnerability is fixed in `@backstage/backend-defaults` versions 0.12.2, 0.13.2, 0.14.1, and 0.15.0; `@backstage/plugin-scaffolder-backend` versions 2.2.2, 3.0.2, and 3.1.1; and `@backstage/plugin-scaffolder-node` versions 0.11.2 and 0.12.3. Users should upgrade to these versions or later. Some workarounds are available. Follow the recommendation in the Backstage Threat Model to limit access to creating and updating templates, restrict who can create and execute Scaffolder templates using the permissions framework, audit existing templates for symlink usage, and/or run Backstage in a containerized environment with limited filesystem access.
Status Published
Exploitability 0.5
Weighted Severity 8.2
Risk 4.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-59 Improper Link Resolution Before File Access ('Link Following')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 9.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-24046.json
epss 0.00022 https://api.first.org/data/v1/epss?cve=CVE-2026-24046
epss 0.00022 https://api.first.org/data/v1/epss?cve=CVE-2026-24046
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-rq6q-wr2q-7pgp
cvssv3.1 7.1 https://github.com/backstage/backstage
generic_textual HIGH https://github.com/backstage/backstage
cvssv3.1 7.1 https://github.com/backstage/backstage/commit/c641c147ab371a9a8a2f5f67fdb7cb9c97ef345d
generic_textual HIGH https://github.com/backstage/backstage/commit/c641c147ab371a9a8a2f5f67fdb7cb9c97ef345d
ssvc Track https://github.com/backstage/backstage/commit/c641c147ab371a9a8a2f5f67fdb7cb9c97ef345d
cvssv3.1 7.1 https://github.com/backstage/backstage/security/advisories/GHSA-rq6q-wr2q-7pgp
cvssv3.1_qr HIGH https://github.com/backstage/backstage/security/advisories/GHSA-rq6q-wr2q-7pgp
generic_textual HIGH https://github.com/backstage/backstage/security/advisories/GHSA-rq6q-wr2q-7pgp
ssvc Track https://github.com/backstage/backstage/security/advisories/GHSA-rq6q-wr2q-7pgp
cvssv3.1 7.1 https://nvd.nist.gov/vuln/detail/CVE-2026-24046
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-24046
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-24046.json
https://api.first.org/data/v1/epss?cve=CVE-2026-24046
https://github.com/backstage/backstage
2431878 https://bugzilla.redhat.com/show_bug.cgi?id=2431878
c641c147ab371a9a8a2f5f67fdb7cb9c97ef345d https://github.com/backstage/backstage/commit/c641c147ab371a9a8a2f5f67fdb7cb9c97ef345d
CVE-2026-24046 https://nvd.nist.gov/vuln/detail/CVE-2026-24046
GHSA-rq6q-wr2q-7pgp https://github.com/advisories/GHSA-rq6q-wr2q-7pgp
GHSA-rq6q-wr2q-7pgp https://github.com/backstage/backstage/security/advisories/GHSA-rq6q-wr2q-7pgp
RHSA-2026:6174 https://access.redhat.com/errata/RHSA-2026:6174
RHSA-2026:6802 https://access.redhat.com/errata/RHSA-2026:6802
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-24046.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L Found at https://github.com/backstage/backstage
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L Found at https://github.com/backstage/backstage/commit/c641c147ab371a9a8a2f5f67fdb7cb9c97ef345d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-22T15:09:21Z/ Found at https://github.com/backstage/backstage/commit/c641c147ab371a9a8a2f5f67fdb7cb9c97ef345d
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L Found at https://github.com/backstage/backstage/security/advisories/GHSA-rq6q-wr2q-7pgp
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-22T15:09:21Z/ Found at https://github.com/backstage/backstage/security/advisories/GHSA-rq6q-wr2q-7pgp
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2026-24046
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.06357
EPSS Score 0.00022
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:52:42.369588+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/24xxx/CVE-2026-24046.json 38.6.0