CVE-2026-24046 is a high severity vulnerability with a CVSS score of 7.1. No known exploits currently, and patches are available.
Very low probability of exploitation
EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.
Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to:
debug:log action by creating a symlink pointing to sensitive files (e.g., /etc/passwd, configuration files, secrets)fs:delete action by creating symlinks pointing outside the workspaceThis affects any Backstage deployment where users can create or execute Scaffolder templates.
This vulnerability is fixed in the following package versions:
@backstage/backend-defaults version 0.12.2, 0.13.2, 0.14.1, 0.15.0@backstage/plugin-scaffolder-backend version 2.2.2, 3.0.2, 3.1.1@backstage/plugin-scaffolder-node version 0.11.2, 0.12.3Users should upgrade to these versions or later.
Please cite this page when referencing data from Strobes VI. Proper attribution helps support our vulnerability intelligence research.