Backstage’s @backstage/backend-defaults package performs improper input validation for cloud storage URL readers. An attacker who can write objects to a bucket used by Backstage can create object names that match those of protected files in the application’s output directory, allowing them to inject content. The flaw maps to path traversal (CWE‑22) and improper input verification (CWE‑73). The CVSS base score of 4.4 indicates a moderate severity.

The vulnerability exists in any deployment that uses @backstage/backend-defaults version prior to 0.17.8 and any Backstage application that incorporates that package. The fix is available starting with backend defaults 0.17.8 and is included in Backstage 1.54.6 and later releases.

The exploit requires write access to the cloud storage bucket used by Backstage, which could be granted to internal users, service accounts, or compromised principals. Without such access, external attackers cannot exploit the flaw. The lack of an EPSS score and absence from the CISA KEV list suggest that large‑scale or automated exploitation is not widespread, but the moderate CVSS score and potential for content injection make the risk non‑negligible for exposed or shared buckets.