Prior to version 1.20.1, Backstage’s SCM URL parsing allowed encoded path traversal sequences to be embedded in file paths. When these URLs were processed by integration functions that build API requests, the traversal segments redirected requests to unintended SCM provider API endpoints while still authenticating with the configured server-side integration credentials. This flaw is a classic directory traversal vulnerability (CWE‑22) that can lead to unauthorized API access or data exposure.

Backstage open‑source framework backed by the Linux Foundation. All installations of backstage:backstage older than 1.20.1 are affected. The vulnerability is tied to the integration components that construct API URLs from SCM URLs.

The CVSS score is 2.7, indicating a low severity overall. The EPSS score is less than 1%, showing a very low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. An attacker would need to supply a crafted SCM URL that contains encoded path traversal sequences. While the attack vector is inferred to involve passing a malicious URL to the integration layer, no external access vector is explicitly documented in the input.