CVE-2026-29185: Backstage Path Traversal Vulnerability

CVE-2026-29185 Overview

CVE-2026-29185 is a Path Traversal vulnerability affecting Backstage, an open framework for building developer portals. Prior to version 1.20.1, a vulnerability in the SCM URL parsing used by Backstage integrations allowed path traversal sequences in encoded form to be included in file paths. When these URLs were processed by integration functions that construct API URLs, the traversal segments could redirect requests to unintended SCM provider API endpoints using the configured server-side integration credentials.

Critical Impact

Attackers with high privileges can exploit encoded path traversal sequences to redirect API requests to unintended SCM provider endpoints, potentially accessing unauthorized resources using server-side integration credentials.

Affected Products

• Backstage versions prior to 1.20.1

Discovery Timeline

• 2026-03-07 - CVE CVE-2026-29185 published to NVD
• 2026-03-09 - Last updated in NVD database

Technical Details for CVE-2026-29185

Vulnerability Analysis

This vulnerability stems from improper input validation in Backstage's SCM (Source Code Management) URL parsing functionality. The integration layer responsible for handling URLs from various SCM providers fails to properly decode and sanitize path traversal sequences before constructing API requests.

When a malicious URL containing encoded path traversal sequences (such as %2e%2e%2f representing ../) is submitted, the parsing logic does not adequately neutralize these sequences. As a result, the constructed API URLs can escape their intended directory context and target arbitrary endpoints on the SCM provider's API infrastructure.

The impact is particularly concerning because the redirected requests inherit the server-side integration credentials configured for legitimate SCM operations, enabling potential unauthorized access to SCM provider resources.

Root Cause

The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal. The vulnerability exists because the URL parsing functions do not properly handle URL-encoded path traversal sequences before incorporating them into API endpoint construction.

The parsing logic fails to decode and validate path components, allowing specially crafted URLs to manipulate the final API request destination while bypassing security checks that may only examine the decoded or surface-level path structure.

Attack Vector

The attack requires network access and high privileges within the Backstage application. An authenticated attacker with elevated permissions can craft malicious SCM URLs containing encoded path traversal sequences.

When Backstage processes these URLs through its integration functions, the encoded traversal sequences are preserved and included in the constructed API URLs. This allows the attacker to redirect requests to unintended SCM provider API endpoints while leveraging the legitimate integration credentials configured on the server.

The attack path involves submitting a crafted URL to a Backstage integration endpoint, where the URL contains encoded traversal patterns that escape the intended API path context and target unauthorized endpoints.

Detection Methods for CVE-2026-29185

Indicators of Compromise

• Unusual SCM API requests containing encoded path traversal sequences such as %2e%2e%2f or %2e%2e/
• API logs showing requests to unexpected endpoints on SCM providers
• Integration credential usage patterns that deviate from normal application behavior

Detection Strategies

• Monitor Backstage integration logs for URL patterns containing encoded directory traversal sequences
• Implement URL decoding in logging pipelines to reveal obfuscated traversal attempts
• Review SCM provider audit logs for API requests that don't match expected application behavior

Monitoring Recommendations

• Enable verbose logging for Backstage SCM integration components
• Configure alerting for API requests containing path traversal patterns in both raw and encoded forms
• Establish baseline behavior for SCM integration credential usage to detect anomalies

How to Mitigate CVE-2026-29185

Immediate Actions Required

• Upgrade Backstage to version 1.20.1 or later immediately
• Review SCM integration logs for any suspicious URL patterns or unauthorized API access
• Audit integration credentials for any signs of misuse or unauthorized activity

Patch Information

This vulnerability has been patched in Backstage version 1.20.1. The patch addresses the improper URL parsing by implementing proper decoding and sanitization of path components before constructing API URLs. Organizations should upgrade to this version or later to remediate the vulnerability.

For additional details, refer to the GitHub Security Advisory.

Workarounds

• Restrict access to Backstage integration features to only essential personnel with verified need
• Implement network-level controls to limit outbound API requests from Backstage to known legitimate SCM endpoints
• Consider temporarily disabling affected SCM integrations until the patch can be applied

# Upgrade Backstage to patched version
npm install @backstage/core@1.20.1

# Or using yarn
yarn upgrade @backstage/core@1.20.1