The vulnerability resides in the resolveSafeChildPath utility used by the @backstage/backend-plugin-api. Before version 0.1.17 this function does not fully validate symlink chains or dangling symlinks, allowing an attacker to craft a chain of symbolic links that finally resolve to a path outside of the intended base directory. This bypass permits reading or writing arbitrary files on the host filesystem when paths processed by tools such as Scaffolder actions are resolved. The weakness is categorized as CWE‑59 (Improper Handling of Relative Pathname) and CWE‑61 (Improper Restriction of Operations within the File System). The direct impact is that a privileged or compromised user can gain file system access beyond the designated sandbox, potentially leading to data exfiltration or configuration manipulation.

Backstage, an open‑source framework for developer portals, is affected. Specifically, the @backstage/cli-common package and the @backstage/backend-plugin-api component under the backstage:backstage vendor. Versions of @backstage/backend-plugin-api older than 0.1.17 contain the flaw. Users deploying Backstage before that release should review their installed package versions. No other product variants are presently documented in the CNA data.

The CVSS base score of 6.3 indicates a moderate severity. The EPSS score is less than 1 percent, reflecting a very low probability of exploitation under current threat data. The vulnerability is not listed in the CISA KEV catalog, and no known active exploits are publicly reported. Exploitation requires the attacker to supply a controlled symlink chain to the resolveSafeChildPath routine, which is generally limited to the context of template creation, file uploads, or local file handling by the Backstage backend. Therefore the attack surface is constrained to environments where an attacker can influence file system operations, such as an untrusted user with the ability to submit templates or an application running with elevated permissions. In absence of such an avenue, the risk remains low to moderate.