GitHub Advisoryadvisory · npm

GHSA-7649-wm97-w3j3 Backstage: Improper input validation in cloud storage URL readers

MEDIUM Published 2026-10-07 Modified 2026-10-07 Official page ↗
Aliases
CVE-2026-106494
Ecosystem
npm
Packages
@backstage/backend-defaults
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-22, CWE-73
Reviewed
2026-10-07

Affected packages

• npm @backstage/backend-defaults: < 0.17.8 → fixed in 0.17.8

Description

Impact An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection. Patches Patched in `@backstage/backend-defaults` version `0.17.8`

Related

Alias · CVE (1)

  • CVE-2026-106494 Backstage is an open framework for building developer portals. vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-73 External Control of File Name or Path weakness

References