Backstage hat einen möglichen Symlink-Pfad-Traversal in Scaffolder Actions

The impact of this vulnerability is significant due to the potential for unauthorized access and modification of sensitive files. An attacker could leverage this flaw to read configuration files, secrets, or even system files like /etc/passwd. Furthermore, the fs:delete action allows for the deletion of arbitrary files outside the intended workspace, potentially disrupting critical infrastructure. The archive extraction functionality introduces another attack vector, enabling attackers to write malicious files outside the workspace by crafting archives containing symlinks. This could lead to code execution or further compromise of the system.

Organizations using @backstage/backend-defaults in their development workflows, particularly those with Scaffolder templates that allow user-defined file paths, are at risk. Shared hosting environments where multiple users can create and execute Scaffolder templates are especially vulnerable.

• nodejs / server:

  find /path/to/backstage/node_modules/@backstage/backend-defaults -type f -name '*.js' -exec grep -i 'debug:log' {} \;

• nodejs / supply-chain: Review Scaffolder template files for suspicious symlink usage (e.g., ../, /etc/passwd). • generic web: Inspect access logs for unusual file access patterns, particularly attempts to access files outside the expected workspace.

1. 2026-01-21Disclosure

   disclosure

1. Reserviert2026-01-20
2. Veröffentlicht2026-01-21
3. Geändert2026-02-03
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-24046 is to upgrade to @backstage/backend-defaults version 0.12.2 or later. If an immediate upgrade is not feasible, consider implementing stricter workspace sandboxing and input validation within your Scaffolder templates to prevent the creation of malicious symlinks. Review and restrict the permissions granted to Scaffolder templates to minimize the potential impact of exploitation. Monitor system logs for suspicious file access or deletion patterns related to Scaffolder actions. After upgrading, confirm the fix by attempting to create a Scaffolder template that utilizes symlinks and verifying that access is restricted.