CVE-2026-24046: 
JavaScript vulnerability analysis and mitigation

CVE-2026-24046 is a symlink-based path traversal vulnerability in Backstage's Scaffolder component, an open framework for building developer portals. Disclosed on January 21, 2026, it affects multiple npm packages: @backstage/backend-defaults (< 0.12.2, >= 0.13.0 < 0.13.2, >= 0.14.0 < 0.14.1), @backstage/plugin-scaffolder-backend (< 2.2.2, >= 3.0.0 < 3.0.2, >= 3.1.0 < 3.1.1), and @backstage/plugin-scaffolder-node (< 0.11.2, >= 0.12.0 < 0.12.3). It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper link resolution before file access (CWE-59) combined with path traversal (CWE-22): Backstage's Scaffolder actions did not validate whether file paths resolved through symlinks remained within the designated workspace directory. Three distinct attack surfaces exist: (1) the debug:log action read file contents without checking if a listed path was a symlink pointing outside the workspace; (2) the fs:delete action deleted files resolved through symlinks without verifying the resolved path stayed within the workspace; and (3) tar/zip archive extraction did not block symlinks with absolute targets or relative targets that escape the extraction directory. The fix introduced resolveSafeChildPath and isChildPath checks across the affected code paths, and symlinks with absolute or out-of-bounds targets are now skipped or rejected (GitHub Commit, GitHub Advisory).

A low-privileged attacker with the ability to create or execute Scaffolder templates can read arbitrary files on the host filesystem (e.g., /etc/passwd, application secrets, configuration files), delete arbitrary files outside the workspace, and write files to arbitrary locations via malicious archives. Because the scope is marked as Changed in the CVSS vector, successful exploitation can affect resources beyond the Backstage application itself, potentially exposing secrets used by other services or corrupting critical system files, which could facilitate lateral movement within the infrastructure (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.016% (0.022% per GitHub Advisory), placing it in the 6th percentile for exploitation likelihood within 30 days. The vulnerability requires low privileges (authenticated template creation/execution access) and high attack complexity, limiting opportunistic exploitation. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys has added detection for this CVE (GitHub Advisory).

1. Gain template access: Obtain a Backstage account with permissions to create and execute Scaffolder templates (low-privilege authenticated access required).
2. Craft a malicious template for file read: Create a Scaffolder template that places a symlink inside the workspace pointing to a sensitive file outside it (e.g., ln -s /etc/passwd /workspace/link), then invoke the debug:log action with listWorkspace: 'with-contents' to read and log the symlink target's contents.
3. Craft a malicious template for file deletion: Create a template that places a symlink inside the workspace pointing to a target directory or file outside the workspace (e.g., ln -s /app/config /workspace/link), then invoke the fs:delete action targeting the symlink path (e.g., link/**) to delete files in the external location.
4. Craft a malicious archive for arbitrary write: Prepare a tar or zip archive containing a symlink entry with an absolute or traversal target (e.g., a symlink link -> /etc/cron.d/backdoor), then use a Scaffolder fetch or extraction action to extract the archive into the workspace, causing files to be written outside the workspace boundary.
5. Exfiltrate or leverage results: Retrieve logged file contents from Backstage logs or observe the effects of deleted/written files to escalate access or pivot within the environment (GitHub Advisory, GitHub Commit).

• Logs: Backstage scaffolder logs showing debug:log action output containing contents of system files (e.g., /etc/passwd entries, secret values); log entries for fs:delete referencing paths outside the expected workspace directory.
• File System: Unexpected symlinks within Backstage workspace directories pointing to absolute paths or locations outside the workspace; newly created or modified files in sensitive directories (e.g., /etc/, /app/config/) with timestamps correlating to Scaffolder task execution.
• Process/Application: Scaffolder task execution records for templates not recognized by administrators, especially those invoking debug:log with listWorkspace: 'with-contents' or fs:delete with glob patterns targeting symlinked paths; archive extraction tasks processing tar/zip files from untrusted sources.

Upgrade to the following patched versions: @backstage/backend-defaults 0.12.2, 0.13.2, 0.14.1, or 0.15.0; @backstage/plugin-scaffolder-backend 2.2.2, 3.0.2, or 3.1.1; @backstage/plugin-scaffolder-node 0.11.2 or 0.12.3. If immediate upgrade is not possible, apply the following workarounds: restrict template creation and execution permissions using Backstage's permissions framework per the Backstage Threat Model; audit existing templates for symlink usage; and run Backstage in a containerized environment with limited filesystem access to reduce the blast radius of exploitation (GitHub Advisory, Red Hat Bugzilla).

The advisory was published by Backstage maintainer Rugvip on January 21, 2026, and Red Hat opened a security tracking bug the same day. CISA included the vulnerability in its weekly bulletin (SB26-026) for the week of January 19, 2026. No significant independent researcher commentary or broad social media discussion has been identified beyond standard vulnerability aggregator coverage (GitHub Advisory, CISA Bulletin).