CVE-2026-24046

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24046", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-20T22:30:11.777Z", "datePublished": "2026-01-21T22:36:30.794Z", "dateUpdated": "2026-07-15T01:17:34.920Z"}, "containers": {"cna": {"title": "Backstage has a Possible Symlink Path Traversal in Scaffolder Actions", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-59", "lang": "en", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/backstage/backstage/security/advisories/GHSA-rq6q-wr2q-7pgp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/backstage/backstage/security/advisories/GHSA-rq6q-wr2q-7pgp"}, {"name": "https://github.com/backstage/backstage/commit/c641c147ab371a9a8a2f5f67fdb7cb9c97ef345d", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/commit/c641c147ab371a9a8a2f5f67fdb7cb9c97ef345d"}], "affected": [{"vendor": "backstage", "product": "backstage", "versions": [{"version": "@backstage/backend-defaults < 0.12.2", "status": "affected"}, {"version": "@backstage/backend-defaults >= 0.13.0, < 0.13.2", "status": "affected"}, {"version": "@backstage/backend-defaults >= 0.14.0, < 0.14.1", "status": "affected"}, {"version": "@backstage/plugin-scaffolder-backend < 2.2.2", "status": "affected"}, {"version": "@backstage/plugin-scaffolder-backend >= 3.0.0, < 3.0.2", "status": "affected"}, {"version": "@backstage/plugin-scaffolder-backend >= 3.1.0, < 3.1.1", "status": "affected"}, {"version": "@backstage/plugin-scaffolder-node < 0.11.2", "status": "affected"}, {"version": "@backstage/plugin-scaffolder-node >= 0.12.0, < 0.12.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-21T22:36:30.794Z"}, "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read arbitrary files via the `debug:log` action by creating a symlink pointing to sensitive files (e.g., `/etc/passwd`, configuration files, secrets); delete arbitrary files via the `fs:delete` action by creating symlinks pointing outside the workspace, and write files outside the workspace via archive extraction (tar/zip) containing malicious symlinks. This affects any Backstage deployment where users can create or execute Scaffolder templates. This vulnerability is fixed in `@backstage/backend-defaults` versions 0.12.2, 0.13.2, 0.14.1, and 0.15.0; `@backstage/plugin-scaffolder-backend` versions 2.2.2, 3.0.2, and 3.1.1; and `@backstage/plugin-scaffolder-node` versions 0.11.2 and 0.12.3. Users should upgrade to these versions or later. Some workarounds are available. Follow the recommendation in the Backstage Threat Model to limit access to creating and updating templates, restrict who can create and execute Scaffolder templates using the permissions framework, audit existing templates for symlink usage, and/or run Backstage in a containerized environment with limited filesystem access."}], "source": {"advisory": "GHSA-rq6q-wr2q-7pgp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-22T15:09:21.771684Z", "id": "CVE-2026-24046", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T16:49:11.684Z"}}, {"affected": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:rhdh:1.8::el9"], "defaultStatus": "affected", "packageName": "rhdh/rhdh-hub-rhel9", "product": "Red Hat Developer Hub 1.8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1774545605", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:rhdh:1.9::el9"], "defaultStatus": "affected", "packageName": "rhdh/rhdh-hub-rhel9", "product": "Red Hat Developer Hub 1.9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1775140647", "versionType": "rpm"}]}], "datePublic": "2026-01-21T22:36:30.794Z", "descriptions": [{"lang": "en", "value": "A flaw was found in Backstage. A symlink-based path traversal issue can be exploited in multiple Scaffolder actions and archive extraction utilities during template execution via malicious symlinks. An attacker with access to create and execute Scaffolder templates can read sensitive files, delete arbitrary files or write files outside the intended workspace, resulting in unauthorized information disclosure or system compromise."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-59", "description": "Improper Link Resolution Before File Access ('Link Following')", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-24046"}, {"name": "RHBZ#2431878", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431878"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24046.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:6174"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:6802"}], "solutions": [{"lang": "en", "value": "RHSA-2026:6174: Red Hat Developer Hub 1.8"}, {"lang": "en", "value": "RHSA-2026:6802: Red Hat Developer Hub 1.9"}], "timeline": [{"lang": "en", "time": "2026-01-21T23:00:53.856Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-01-21T22:36:30.794Z", "value": "Made public."}], "title": "backstage/backend-defaults: backstage/plugin-scaffolder-backend: backstage/plugin-scaffolder-node: possible symlink path traversal in scaffolder actions", "workarounds": [{"lang": "en", "value": "To mitigate this issue, consider implementing strict access controls for Backstage Scaffolder templates. Restrict the ability to create and execute Scaffolder templates to trusted users only, utilizing the Backstage permissions framework. Additionally, audit existing templates for any symlink usage and consider running Backstage within a containerized environment with a highly restricted filesystem to limit potential impact."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-15T01:17:34.920Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "backstage/backend-defaults: backstage/plugin-scaffolder-backend: backstage/plugin-scaffolder-node: possible symlink path traversal in scaffolder actions", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:rhdh:1.8::el9"], "vendor": "Red Hat", "product": "Red Hat Developer Hub 1.8", "versions": [{"status": "unaffected", "version": "1774545605", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhdh/rhdh-hub-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhdh:1.9::el9"], "vendor": "Red Hat", "product": "Red Hat Developer Hub 1.9", "versions": [{"status": "unaffected", "version": "1775140647", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhdh/rhdh-hub-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-01-21T23:00:53.856Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-01-21T22:36:30.794Z", "value": "Made public."}], "solutions": [{"lang": "en", "value": "RHSA-2026:6174: Red Hat Developer Hub 1.8"}, {"lang": "en", "value": "RHSA-2026:6802: Red Hat Developer Hub 1.9"}], "x_adpType": "supplier", "datePublic": "2026-01-21T22:36:30.794Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-24046", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431878", "name": "RHBZ#2431878", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24046.json", "tags": ["x_sadp-csaf-vex"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:6174", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:6802", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "To mitigate this issue, consider implementing strict access controls for Backstage Scaffolder templates. Restrict the ability to create and execute Scaffolder templates to trusted users only, utilizing the Backstage permissions framework. Additionally, audit existing templates for any symlink usage and consider running Backstage within a containerized environment with a highly restricted filesystem to limit potential impact."}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in Backstage. A symlink-based path traversal issue can be exploited in multiple Scaffolder actions and archive extraction utilities during template execution via malicious symlinks. An attacker with access to create and execute Scaffolder templates can read sensitive files, delete arbitrary files or write files outside the intended workspace, resulting in unauthorized information disclosure or system compromise."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "Improper Link Resolution Before File Access ('Link Following')"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-15T01:17:34.920Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24046", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-22T15:09:21.771684Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T15:09:22.979Z"}}], "cna": {"title": "Backstage has a Possible Symlink Path Traversal in Scaffolder Actions", "source": {"advisory": "GHSA-rq6q-wr2q-7pgp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "backstage", "product": "backstage", "versions": [{"status": "affected", "version": "@backstage/backend-defaults < 0.12.2"}, {"status": "affected", "version": "@backstage/backend-defaults >= 0.13.0, < 0.13.2"}, {"status": "affected", "version": "@backstage/backend-defaults >= 0.14.0, < 0.14.1"}, {"status": "affected", "version": "@backstage/plugin-scaffolder-backend < 2.2.2"}, {"status": "affected", "version": "@backstage/plugin-scaffolder-backend >= 3.0.0, < 3.0.2"}, {"status": "affected", "version": "@backstage/plugin-scaffolder-backend >= 3.1.0, < 3.1.1"}, {"status": "affected", "version": "@backstage/plugin-scaffolder-node < 0.11.2"}, {"status": "affected", "version": "@backstage/plugin-scaffolder-node >= 0.12.0, < 0.12.3"}]}], "references": [{"url": "https://github.com/backstage/backstage/security/advisories/GHSA-rq6q-wr2q-7pgp", "name": "https://github.com/backstage/backstage/security/advisories/GHSA-rq6q-wr2q-7pgp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/backstage/backstage/commit/c641c147ab371a9a8a2f5f67fdb7cb9c97ef345d", "name": "https://github.com/backstage/backstage/commit/c641c147ab371a9a8a2f5f67fdb7cb9c97ef345d", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read arbitrary files via the `debug:log` action by creating a symlink pointing to sensitive files (e.g., `/etc/passwd`, configuration files, secrets); delete arbitrary files via the `fs:delete` action by creating symlinks pointing outside the workspace, and write files outside the workspace via archive extraction (tar/zip) containing malicious symlinks. This affects any Backstage deployment where users can create or execute Scaffolder templates. This vulnerability is fixed in `@backstage/backend-defaults` versions 0.12.2, 0.13.2, 0.14.1, and 0.15.0; `@backstage/plugin-scaffolder-backend` versions 2.2.2, 3.0.2, and 3.1.1; and `@backstage/plugin-scaffolder-node` versions 0.11.2 and 0.12.3. Users should upgrade to these versions or later. Some workarounds are available. Follow the recommendation in the Backstage Threat Model to limit access to creating and updating templates, restrict who can create and execute Scaffolder templates using the permissions framework, audit existing templates for symlink usage, and/or run Backstage in a containerized environment with limited filesystem access."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-21T22:36:30.794Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24046", "state": "PUBLISHED", "dateUpdated": "2026-07-15T01:17:34.920Z", "dateReserved": "2026-01-20T22:30:11.777Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-21T22:36:30.794Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "backstage", "vendor": "backstage", "versions": [{"status": "affected", "version": "@backstage/backend-defaults < 0.12.2"}, {"status": "affected", "version": "@backstage/backend-defaults >= 0.13.0, < 0.13.2"}, {"status": "affected", "version": "@backstage/backend-defaults >= 0.14.0, < 0.14.1"}, {"status": "affected", "version": "@backstage/plugin-scaffolder-backend < 2.2.2"}, {"status": "affected", "version": "@backstage/plugin-scaffolder-backend >= 3.0.0, < 3.0.2"}, {"status": "affected", "version": "@backstage/plugin-scaffolder-backend >= 3.1.0, < 3.1.1"}, {"status": "affected", "version": "@backstage/plugin-scaffolder-node < 0.11.2"}, {"status": "affected", "version": "@backstage/plugin-scaffolder-node >= 0.12.0, < 0.12.3"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:rhdh:1.8::el9"], "defaultStatus": "affected", "packageName": "rhdh/rhdh-hub-rhel9", "product": "Red Hat Developer Hub 1.8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1774545605", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:rhdh:1.9::el9"], "defaultStatus": "affected", "packageName": "rhdh/rhdh-hub-rhel9", "product": "Red Hat Developer Hub 1.9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1775140647", "versionType": "rpm"}]}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read arbitrary files via the `debug:log` action by creating a symlink pointing to sensitive files (e.g., `/etc/passwd`, configuration files, secrets); delete arbitrary files via the `fs:delete` action by creating symlinks pointing outside the workspace, and write files outside the workspace via archive extraction (tar/zip) containing malicious symlinks. This affects any Backstage deployment where users can create or execute Scaffolder templates. This vulnerability is fixed in `@backstage/backend-defaults` versions 0.12.2, 0.13.2, 0.14.1, and 0.15.0; `@backstage/plugin-scaffolder-backend` versions 2.2.2, 3.0.2, and 3.1.1; and `@backstage/plugin-scaffolder-node` versions 0.11.2 and 0.12.3. Users should upgrade to these versions or later. Some workarounds are available. Follow the recommendation in the Backstage Threat Model to limit access to creating and updating templates, restrict who can create and execute Scaffolder templates using the permissions framework, audit existing templates for symlink usage, and/or run Backstage in a containerized environment with limited filesystem access."}, {"lang": "es", "value": "Backstage es un framework abierto para construir portales de desarrolladores. M\u00faltiples acciones de Scaffolder y utilidades de extracci\u00f3n de archivos eran vulnerables a ataques de salto de ruta basados en symlinks. Un atacante con acceso para crear y ejecutar plantillas de Scaffolder podr\u00eda explotar symlinks para leer archivos arbitrarios a trav\u00e9s de la acci\u00f3n debug:log creando un symlink que apunte a archivos sensibles (p. ej., /etc /passwd, archivos de configuraci\u00f3n, secretos); eliminar archivos arbitrarios a trav\u00e9s de la acci\u00f3n fs:delete creando symlinks que apunten fuera del espacio de trabajo, y escribir archivos fuera del espacio de trabajo a trav\u00e9s de la extracci\u00f3n de archivos (tar/zip) que contengan symlinks maliciosos. Esto afecta a cualquier implementaci\u00f3n de Backstage donde los usuarios puedan crear o ejecutar plantillas de Scaffolder. Esta vulnerabilidad est\u00e1 corregida en las versiones 0.12.2, 0.13.2, 0.14.1 y 0.15.0 de @backstage/backend-defaults; las versiones 2.2.2, 3.0.2 y 3.1.1 de @backstage/plugin-scaffolder-backend; y las versiones 0.11.2 y 0.12.3 de @backstage/plugin-scaffolder-node. Los usuarios deben actualizar a estas versiones o posteriores. Hay algunas soluciones alternativas disponibles. Siga la recomendaci\u00f3n en el Modelo de Amenazas de Backstage para limitar el acceso a la creaci\u00f3n y actualizaci\u00f3n de plantillas, restringir qui\u00e9n puede crear y ejecutar plantillas de Scaffolder utilizando el framework de permisos, auditar las plantillas existentes en busca de uso de symlinks, y/o ejecutar Backstage en un entorno en contenedores con acceso limitado al sistema de archivos."}], "id": "CVE-2026-24046", "lastModified": "2026-07-15T02:18:47.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 5.3, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24046", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-22T15:09:21.771684Z", "version": "2.0.3"}}]}, "published": "2026-01-21T23:15:53.240", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/backstage/backstage/commit/c641c147ab371a9a8a2f5f67fdb7cb9c97ef345d"}, {"source": "security-advisories@github.com", "url": "https://github.com/backstage/backstage/security/advisories/GHSA-rq6q-wr2q-7pgp"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:6174"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:6802"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-24046"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431878"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24046.json"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-59"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-59"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "backstage/backend-defaults: backstage/plugin-scaffolder-backend: backstage/plugin-scaffolder-node: possible symlink path traversal in scaffolder actions", "id": "2431878", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431878"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L", "status": "draft"}, "cwe": "(CWE-22|CWE-59)", "details": ["Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read arbitrary files via the `debug:log` action by creating a symlink pointing to sensitive files (e.g., `/etc/passwd`, configuration files, secrets); delete arbitrary files via the `fs:delete` action by creating symlinks pointing outside the workspace, and write files outside the workspace via archive extraction (tar/zip) containing malicious symlinks. This affects any Backstage deployment where users can create or execute Scaffolder templates. This vulnerability is fixed in `@backstage/backend-defaults` versions 0.12.2, 0.13.2, 0.14.1, and 0.15.0; `@backstage/plugin-scaffolder-backend` versions 2.2.2, 3.0.2, and 3.1.1; and `@backstage/plugin-scaffolder-node` versions 0.11.2 and 0.12.3. Users should upgrade to these versions or later. Some workarounds are available. Follow the recommendation in the Backstage Threat Model to limit access to creating and updating templates, restrict who can create and execute Scaffolder templates using the permissions framework, audit existing templates for symlink usage, and/or run Backstage in a containerized environment with limited filesystem access.", "A flaw was found in Backstage. A symlink-based path traversal issue can be exploited in multiple Scaffolder actions and archive extraction utilities during template execution via malicious symlinks. An attacker with access to create and execute Scaffolder templates can read sensitive files, delete arbitrary files or write files outside the intended workspace, resulting in unauthorized information disclosure or system compromise."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, consider implementing strict access controls for Backstage Scaffolder templates. Restrict the ability to create and execute Scaffolder templates to trusted users only, utilizing the Backstage permissions framework. Additionally, audit existing templates for any symlink usage and consider running Backstage within a containerized environment with a highly restricted filesystem to limit potential impact."}, "name": "CVE-2026-24046", "package_state": [{"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Affected", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub"}], "public_date": "2026-01-21T22:36:30Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-24046\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-24046\nhttps://github.com/backstage/backstage/commit/c641c147ab371a9a8a2f5f67fdb7cb9c97ef345d\nhttps://github.com/backstage/backstage/security/advisories/GHSA-rq6q-wr2q-7pgp"], "statement": "To exploit this issue, an attacker needs to have access to create and execute Scaffolder actions, specifically the debug:log, fs:delete actions and archive extractions, limiting the exposure of this flaw. Additionally, file systems operations are constrained by the permissions of the process, limiting the impact to files that can be accessed by Backstage. Due to these reasons, this vulnerability has been rated with an important severity.", "threat_severity": "Important"}

{"analysis": {"en": {"generated_at": "2026-04-18T04:05:07.962090+00:00", "value": {"mitigation_remediation": ["Upgrade to the latest patched versions of @backstage/backend-defaults, @backstage/plugin-scaffolder-backend, and @backstage/plugin-scaffolder-node.", "Restrict permissions so that only trusted users can create or update scaffolder templates using the Backstage permissions framework.", "Audit existing templates for symlink usage to identify and remediate malicious or vulnerable links.", "Run Backstage in a containerized environment with limited filesystem access to contain potential traversal attacks."], "summary": {"action": "Patch Immediately", "impact": "Path traversal allowing arbitrary file read, delete, and write"}, "threat_synthesis": {"affected_systems": "Affected deployments include any Backstage instance that permits users to create or execute scaffolder templates. The issue was fixed in specific package versions: @backstage/backend-defaults 0.12.2, 0.13.2, 0.14.1, and 0.15.0; @backstage/plugin-scaffolder-backend 2.2.2, 3.0.2, and 3.1.1; and @backstage/plugin-scaffolder-node 0.11.2 and 0.12.3. Versions older than these are vulnerable.", "description_and_impact": "Backstage, an open framework for developer portals, has a flaw in several scaffolder actions and its archive extraction utilities that allows symlink-based path traversal. An attacker that can create and run scaffolder templates can supply files that point to arbitrary locations on the host filesystem, leading to unauthorized reading, deletion, or creation of files outside the intended workspace.", "risk_and_exploitability": "The CVSS score of 7.1 indicates moderate to high severity; the EPSS score of less than 1% suggests low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to craft templates, but once achieved the attacker can read sensitive files such as /etc/passwd, delete arbitrary files, or write files outside the workspace through archive extraction containing malicious symlinks."}}}}, "created": "2026-01-22T10:08:40.254678+00:00", "updated": "2026-04-18T04:15:05.871477+00:00", "vendors": ["backstage", "backstage$PRODUCT$backstage"]}