GHSA-7649-wm97-w3j3: Path Traversal

Q: Who is exposed to this issue?

Deployments using @backstage/backend-defaults that ingest content from a cloud storage bucket are exposed when an attacker has write access to that bucket. The impact depends on the deployment configuration and can result in content injection.

Q: What level of access does an attacker need?

The attacker needs write access to the cloud storage bucket used by Backstage. Exploitation also requires crafting object names that collide with protected files in the output directory.

Q: Which version contains the fix?

The issue is patched in @backstage/backend-defaults version 0.17.8.

Published Oct 7, 2026

Updated

Impact

An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection.

Patches

Patched in @backstage/backend-defaults version 0.17.8

Affected Software

1 affected componentFixes available

npm/@backstage/backend-defaults<0.17.8

0.17.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/@backstage/backend-defaults to a version that resolves this vulnerability.
Fixed in 0.17.8
Upgrade
Upgrade @backstage/backend-defaults to a version that resolves this vulnerability.
Fixed in 0.17.8

Event History

Oct 7, 2026

Advisory Published

via GitHub·05:59 PM

Data Sourced

via GitHub·05:59 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Deployments using @backstage/backend-defaults that ingest content from a cloud storage bucket are exposed when an attacker has write access to that bucket. The impact depends on the deployment configuration and can result in content injection.

What level of access does an attacker need?

The attacker needs write access to the cloud storage bucket used by Backstage. Exploitation also requires crafting object names that collide with protected files in the output directory.

Which version contains the fix?

The issue is patched in @backstage/backend-defaults version 0.17.8.

GHSA-7649-wm97-w3j3: Path Traversal

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What level of access does an attacker need?

Which version contains the fix?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What level of access does an attacker need?

Which version contains the fix?