The flaw resides in Backstage’s cloud storage catalog providers, which failed to properly validate object paths. A privileged user who can create or rename objects in an Azure Blob Storage or AWS S3 catalog source could read catalog descriptor files from outside the intended storage boundary. This allows the attacker to expose data stored in unintended locations, potentially including sensitive configuration or metadata. The vulnerability does not permit arbitrary code execution or a full system takeover; the impact is limited to information disclosure within the storage account’s scope.

The affected components are the Backstage framework itself and its backend modules for AWS and Azure. Any installation using Backstage version 1.54.5 or earlier is vulnerable. Versions 1.54.6 and later contain the necessary path‑validation fix. Administrators should verify that the Backstage instance and its plugin modules are upgraded to 1.54.6 or later.

The CVSS score of 3 classifies the flaw as low severity, and the EPSS score is not available, implying limited public exploitation data. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker already possesses a principal with permissions to create or rename objects in the configured storage bucket, meaning it is generally a credential‑compromise or privilege‑elevation scenario rather than a publicly exploitable remote attack. The attack path therefore is confined to environments where the attacker can manipulate storage objects but may read additional unintended objects within the same storage account.