CVE-2026-106500: backstage Link Following
Vulnerability summary
CVE-2026-106500 is a high (CVSS 8.5) Link Following vulnerability in backstage. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 25.4% of scored vulnerabilities.
Timeline
- 06-10-2026PublishedVulnerability first disclosed.
- 07-10-2026Last modifiedVulnerability information updated.
Description
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper task state validation in scaffolder backend. An authenticated user with permission to create and access Scaffolder tasks may, under specific timing and deployment conditions, affect files accessible to the Backstage backend. If backend application files are writable, the confidentiality, integrity, and availability of the backend may be compromised. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · NpmEcosystem advisory · calculated8.5HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
- NVDNIST8.5HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.34%
Chance of exploitation in the next 30 days
Percentile
25%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
- CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Affected systems
@backstage2 products
- plugin-scaffolder-backend< 3.3.1 | ≥ 3.4.0, < 3.4.1 | ≥ 4.0.0, < 4.0.3 | ≥ 4.0.4, < 4.1.0
- plugin-scaffolder-backend< 4.1.0
Linuxfoundation2 products
- backstage< 1.49.6 | ≥ 1.50.0, < 1.50.5 | ≥ 1.51.0, < 1.54.6
- backstage\/plugin-scaffolder-backend< 3.3.1 | ≥ 3.4.0, < 3.4.1 | ≥ 4.0.0, < 4.0.3 | ≥ 4.0.4, < 4.1.0
Backstage1 product
- backstage< 1.49.6 | ≥ 1.50.0-next.0, < 1.50.5 | ≥ 1.51.0-next.0, < 1.54.6
3 vendors · 5 products
References
9 links- github.com/backstage/backstage/security/advisories/GHSA-xvgh-hmx8-9xxfX Refsource CONFIRMWEBMitigationVendor Advisory
- github.com/backstage/backstage/commit/0d24f1b8701f3dde6cd597f81997c1ea873a43aeX Refsource MISCWEBPatch
- github.com/backstage/backstage/commit/56be299dd3ef6706e13e76ea2f8a9b0dd0b6413dX Refsource MISCWEBPatch
- github.com/backstage/backstage/commit/9e86c95a1a3ddfd54db03731cd8678aa63495175X Refsource MISCWEBPatch
