Vulnerability GHSA-xvh9-35w9-42m4
Low Risk
LOW RISK
CVSS Score: 3.0
Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
8 days ago
October 07, 2026 at 05:59 PM UTC
Backstage: Cloud storage catalog locations may cross configured storage boundaries
0.0.0-nightly-20220811024336 - 0.17.7
0.0.0-nightly-20220811024336 - 0.17.7
Summary
Backstage: Cloud storage catalog locations may cross configured storage boundaries
Details
Impact
Catalog entity providers for Azure Blob Storage and AWS S3 did not sufficiently validate storage object paths, which could allow catalog descriptors to be read from outside the intended storage boundary. Access is limited to locations reachable by the backend's configured credentials.
Patches
@backstage/plugin-catalog-backend-module-azureversion0.3.21@backstage/plugin-catalog-backend-module-awsversion0.4.27@backstage/backend-defaultsversion0.7.18
Workarounds
- Restrict blob and object creation or renaming in configured catalog storage sources to trusted principals.
- Scope Backstage's Azure and AWS reader credentials and network access to the intended storage boundaries.
- Disable an affected catalog provider if those restrictions cannot be enforced.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
6 hours ago
Backstage: Improper access control in backend action invocation
0.0.0-nightly-20220811024336 - 0.17.7 GHSA-3xr5-8w6c-p5gw
0.0.0-nightly-20220811024336 - 0.17.7 GHSA-3xr5-8w6c-p5gw
High Risk
8 days ago
Backstage: Improper preservation of access restrictions during service credential delegation
0.0.0-nightly-20220811024336 - 0.17.7 GHSA-cq7v-rfgc-5c7v
0.0.0-nightly-20220811024336 - 0.17.7 GHSA-cq7v-rfgc-5c7v
Medium Risk
8 days ago
Backstage: Improper input validation in cloud storage URL readers
0.0.0-nightly-20220811024336 - 0.17.7 GHSA-7649-wm97-w3j3
0.0.0-nightly-20220811024336 - 0.17.7 GHSA-7649-wm97-w3j3
Low Risk
8 months ago
Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow`
0.0.0-nightly-20220811024336 - 0.12.1 and 0.13.0 - 0.13.1 and 0.14.0 - 0.14.1-next.1 GHSA-q2x5-4xjx-c6p9
0.0.0-nightly-20220811024336 - 0.12.1 and 0.13.0 - 0.13.1 and 0.14.0 - 0.14.1-next.1 GHSA-q2x5-4xjx-c6p9
High Risk
8 months ago
Backstage has a Possible Symlink Path Traversal in Scaffolder Actions
0.0.0-nightly-20220811024336 - 0.12.1 and 0.13.0 - 0.13.1 and 0.14.0 - 0.14.1-next.1 GHSA-rq6q-wr2q-7pgp
0.0.0-nightly-20220811024336 - 0.12.1 and 0.13.0 - 0.13.1 and 0.14.0 - 0.14.1-next.1 GHSA-rq6q-wr2q-7pgp
Impacted packages
Timeline
Published
8 days ago
October 07, 2026 at 05:59 PM UTC
Fixed (0.17.8)
1 month ago
August 28, 2026 at 08:18 AM UTC
Fixed (0.4.27)
1 month ago
August 28, 2026 at 08:18 AM UTC
Fixed (0.3.21)
1 month ago
August 28, 2026 at 08:18 AM UTC
Last Modified
8 days ago
October 07, 2026 at 06:15 PM UTC