Vendor

backstage

73 known vulnerabilities.

Products

backstage 69 plugin-scaffolder-backend 10 plugin-techdocs-node 8 plugin-catalog-backend 3 backend-defaults 3 plugin-kubernetes-backend 3 plugin-auth-backend 2 plugin-techdocs-backend 2 plugin-scaffolder-backend-module-confluence-to-markdown 2 plugin-proxy-backend 2 plugin-scaffolder-backend-module-bitbucket-cloud 2 plugin-scaffolder-backend-module-bitbucket-server 2 plugin-catalog-backend-module-azure 1 plugin-catalog-backend-module-aws 1 plugin-auth-backend-module-cloudflare-access-provider 1 plugin-catalog-backend-module-unprocessed 1 plugin-catalog-unprocessed-entities 1 plugin-catalog-unprocessed-entities-common 1 plugin-search-backend 1 plugin-search-backend-module-elasticsearch 1 plugin-auth-node 1 plugin-catalog-backend-module-bitbucket-server 1 plugin-scaffolder-backend-module-sentry 1 plugin-catalog-backend-module-gitlab 1 plugin-scaffolder-backend-module-azure 1 plugin-scaffolder-backend-module-github 1 plugin-scaffolder-backend-module-gitlab 1 plugin-auth-backend-module-oidc-provider 1

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

High 7.1

CVE-2026-24046 Public exploit

Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could explo…

backstage backstage @backstage/plugin-scaffolder-backend @backstage/backend-defaults npm

Jan 21, 2026