The vulnerability affects the @backstage/plugin‑proxy‑backend component, allowing an authenticated Backstage user to craft a request URL that causes the proxy‑backend to forward the request to a path outside the configured base path on the target server. This enables the attacker to access resources on the target server that are not intended to be exposed through the proxy. The weakness is an improper input validation (CWE‑20) that leads to path traversal (CWE‑22).

The issue impacts Backstage installations that use the @backstage/plugin‑proxy‑backend package prior to version 0.6.17. The related Backstage core backward compatible packages are also affected before the release that includes the fix, which is bundled in Backstage releases starting at or after tag v1.54.6. Any environment that has configured external backend servers as proxy endpoints and authenticates users to the platform is potentially vulnerable.

The CVSS score of 6.4 indicates a medium severity. The exploit probability is unknown as no EPSS value is available, and the vulnerability is not listed in the CISA KEV catalog. However, the attack requires valid Backstage authentication and access to a configured proxy endpoint, so its exploitation would likely be limited to compromised or insider users. Nevertheless, once authenticated, the attacker could reach internal resources on the target server, potentially leaking confidential data or facilitating further lateral movement. The vulnerability is fixed in version 0.6.17, so upgrading will eliminate the risk.