Backstage, an open framework for developer portals, has a flaw in several scaffolder actions and its archive extraction utilities that allows symlink-based path traversal. An attacker that can create and run scaffolder templates can supply files that point to arbitrary locations on the host filesystem, leading to unauthorized reading, deletion, or creation of files outside the intended workspace.

Affected deployments include any Backstage instance that permits users to create or execute scaffolder templates. The issue was fixed in specific package versions: @backstage/backend-defaults 0.12.2, 0.13.2, 0.14.1, and 0.15.0; @backstage/plugin-scaffolder-backend 2.2.2, 3.0.2, and 3.1.1; and @backstage/plugin-scaffolder-node 0.11.2 and 0.12.3. Versions older than these are vulnerable.

The CVSS score of 7.1 indicates moderate to high severity; the EPSS score of less than 1% suggests low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to craft templates, but once achieved the attacker can read sensitive files such as /etc/passwd, delete arbitrary files, or write files outside the workspace through archive extraction containing malicious symlinks.