CVE-2026-106494: Backstage Path Traversal Vulnerability

CVE-2026-106494 Overview

CVE-2026-106494 affects Backstage, an open framework for building developer portals. The @backstage/backend-defaults package contains an improper input validation flaw in its cloud storage URL readers. An attacker with write access to a cloud storage bucket consumed by Backstage can craft object names that collide with protected files in the output directory. In certain deployment configurations, this behavior leads to content injection. The issue is tracked as CWE-22 (Path Traversal) and is fixed in Backstage version 0.17.8.

Critical Impact
An authenticated attacker with bucket write access can overwrite protected files inside a Backstage instance, enabling content injection into developer portal outputs.

Affected Products

Backstage @backstage/backend-defaults package prior to 0.17.8
Backstage deployments using AWS S3 URL readers (AwsS3UrlReader)
Backstage deployments using AWS CodeCommit URL readers (AwsCodeCommitUrlReader)

Discovery Timeline

2026-10-06 - CVE-2026-106494 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-106494

Vulnerability Analysis

The vulnerability resides in the cloud storage URL readers shipped by @backstage/backend-defaults. These readers fetch objects from AWS S3 and AWS CodeCommit and write them to a local output directory on the Backstage backend. Prior to the fix, the readers did not validate object names for traversal sequences such as ... An attacker who can write objects into a configured bucket can set object keys that resolve outside the intended output path. The result is that content from the bucket overwrites protected files used by the Backstage deployment.

Root Cause

The readers trusted object keys returned by cloud storage providers without checking for dot-path segments. Because object names are treated as relative paths during extraction, keys containing ../ traverse the output directory. The remediation introduces a shared hasDotPathSegments helper that both AwsS3UrlReader and AwsCodeCommitUrlReader call before writing files.

Attack Vector

Exploitation requires the attacker to already hold write privileges to a cloud storage bucket that Backstage reads from. The attacker uploads an object whose key contains traversal segments pointing to a protected file in the backend output directory. When Backstage next reads the bucket, the malicious object overwrites the target file. In deployments that serve those files to users, this yields content injection into the developer portal.

typescript

// Patch excerpt: AwsS3UrlReader.ts
 import { ReadUrlResponseFactory } from './ReadUrlResponseFactory';
 import { Readable } from 'node:stream';
 import { relative } from 'node:path/posix';
+import { hasDotPathSegments } from './util';
 
 export const DEFAULT_REGION = 'us-east-1';

// Patch excerpt: AwsCodeCommitUrlReader.ts
 import { ReadUrlResponseFactory } from './ReadUrlResponseFactory';
 import { relative } from 'node:path/posix';
 import { AbortController } from '@aws-sdk/abort-controller';
+import { hasDotPathSegments } from './util';

 export function parseUrl(
   url: string,

Source: Backstage commit 14e925c

Detection Methods for CVE-2026-106494

Indicators of Compromise

Objects in Backstage-connected S3 or CodeCommit sources whose keys contain .., ./, or backslash traversal segments.
Unexpected file modifications in the Backstage backend output directory that correspond in time to bucket write events.
Serving of altered static assets, templates, or catalog descriptor files from the Backstage portal.

Detection Strategies

Audit CloudTrail PutObject and CodeCommit PutFile events for keys containing dot-path segments against buckets configured as Backstage URL reader sources.
Inspect installed @backstage/backend-defaults versions across build artifacts and runtime containers, flagging any version below 0.17.8.
Review Backstage configuration (app-config.yaml) for integrations.awsS3 and integrations.awsCodeCommit entries and map each to the writers who can push to those buckets.

Monitoring Recommendations

Enable S3 server access logging and CloudTrail data events on buckets consumed by Backstage.
Alert on file writes to Backstage output directories originating from URL reader processes outside normal deploy windows.
Track principals with write access to Backstage source buckets and review changes to their IAM policies.

How to Mitigate CVE-2026-106494

Immediate Actions Required

Upgrade @backstage/backend-defaults to version 0.17.8 or later and redeploy Backstage.
Review bucket write permissions and revoke access from identities that do not require it.
Scan existing bucket contents for object keys containing .. or other traversal sequences and remove them.

Patch Information

The fix is included in Backstage release v1.54.6 and corresponds to commit 14e925c. Full remediation details are available in GitHub Security Advisory GHSA-7649-wm97-w3j3.

Workarounds

Restrict write permissions on buckets referenced by AwsS3UrlReader and AwsCodeCommitUrlReader to trusted automation identities only.
Enforce object key naming policies at the bucket level, rejecting keys that contain .. or path separators that resolve outside expected prefixes.
Isolate the Backstage output directory on a dedicated filesystem mount with least-privilege write access to limit the blast radius of content overwrites.

bash

# Upgrade Backstage backend-defaults to the fixed version
yarn up @backstage/backend-defaults@^0.17.8
yarn install
yarn tsc
yarn build:backend