CVE-2026-29185
LOWBackstage Integration < 1.20.1 - Path Traversal via Encoded SCM URL
Title source: llmDescription
Backstage is an open framework for building developer portals. Prior to version 1.20.1, a vulnerability in the SCM URL parsing used by Backstage integrations allowed path traversal sequences in encoded form to be included in file paths. When these URLs were processed by integration functions that construct API URLs, the traversal segments could redirect requests to unintended SCM provider API endpoints using the configured server-side integration credentials. This issue has been patched in version 1.20.1.
References (1)
Core 1
Core References
Vendor Advisory x_refsource_confirm
https://github.com/backstage/backstage/security/advisories/GHSA-95v5-prp4-5gv5
Scores
CVSS v3
2.7
EPSS
0.0035
EPSS Percentile
26.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-22
Status
published
Products (3)
backstage/integration
0 - 1.20.1npm
linuxfoundation/\@backstage\/integration
< 1.20.1
linuxfoundation/backstage\/integration
< 1.20.1
Published
Mar 07, 2026
Tracked Since
Mar 07, 2026