PT-2026-23440 · Netflix · Backstage

Published 2026-03-05 · Updated 2026-03-07 · CVE-2026-29185

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.20.1

Description Backstage is a framework for building developer portals. A flaw in how Backstage handles SCM URLs within integrations permitted path traversal sequences, even when encoded. This allowed requests to be redirected to unintended SCM provider API endpoints using integration credentials when processing URLs in integration functions. The issue impacts instances utilizing SCM integrations like GitHub, Bitbucket Server, and Bitbucket Cloud with features accepting user-provided SCM URLs. The vulnerable component is the SCM URL parsing used by Backstage integrations. The affected API endpoints are those of the SCM provider, potentially accessed through the integration functions. The vulnerable variable is the SCM URL itself.

Recommendations Upgrade to Backstage version 1.20.1 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-29185

GHSA-95V5-PRP4-5GV5

Affected Products

Backstage

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29185.json · Exploit
• https://github.com/backstage/backstage/security/advisories/GHSA-95v5-prp4-5gv5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-29185 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-95v5-prp4-5gv5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29185 · Security Note
• https://github.com/backstage/backstage · Note
• https://twitter.com/CVEnew/status/2030339315491025399 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2030319350989598721 · Twitter Post
• https://t.me/cveNotify/154591 · Telegram Post