CVE-2026-106560: Backstage: Improper repository path validation in a Scaffolder backend module

October 7, 2026

An authenticated user who can execute an affected template and control its repository file location may cause generated content to be written outside the task workspace, within locations writable by the Backstage backend process.

References

github.com/advisories/GHSA-2cmg-v53w-8xfp
github.com/backstage/backstage/commit/5f0000c1d0af05571e357926b3fa33a453337ff0
github.com/backstage/backstage/releases/tag/v1.54.6
github.com/backstage/backstage/security/advisories/GHSA-2cmg-v53w-8xfp
nvd.nist.gov/vuln/detail/CVE-2026-106560

Code Behaviors & Features

Detect and mitigate CVE-2026-106560 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →