High · published January 21, 2026
⚡ Backstage is letting attackers sneak around the filesystem like a cat burglar with a master key! Think of Scaffolder actions as a pizza place where anyone can create their own orders. If a sneaky individual can slip in a crafted order, they could not only see the chef’s secret recipes but also toss out the entire stock of ingredients just by tweaking their order! An attacker with access to create Scaffolder templates could read sensitive files like passwords and configurations, delete important resources, or even write malicious files anywhere on the server. Imagine your entire server setup being compromised because someone found a backdoor through an innocent-looking template!
Think of Scaffolder actions as a pizza place where anyone can create their own orders. If a sneaky individual can slip in a crafted order, they could not only see the chef’s secret recipes but also toss out the entire stock of ingredients just by tweaking their order! This vulnerability allows symlink-based path traversal, enabling attackers to exploit the `debug:log` action and other Scaffolder actions to manipulate files and directories outside the intended workspace.
An attacker with access to create Scaffolder templates could read sensitive files like passwords and configurations, delete important resources, or even write malicious files anywhere on the server. Imagine your entire server setup being compromised because someone found a backdoor through an innocent-looking template! To protect your Backstage deployment, upgrade to the latest versions of `@backstage/backend-defaults`, `@backstage/plugin-scaffolder-backend`, and `@backstage/plugin-scaffolder-node`. Additionally, restrict template creation and execution permissions, audit existing templates for symlink usage, and consider running Backstage in a containerized environment with limited filesystem access. You've got this! Follow the steps, and you'll lock down your Backstage environment like a pro! 🛡️