{"id":"GHSA-7649-wm97-w3j3","revision":"13c43ceb53fe4bc9b3dd4a7eb74c575c","records":[{"revision":"13c43ceb53fe4bc9b3dd4a7eb74c575c","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-7649-wm97-w3j3","aliases":["CVE-2026-106494"],"title":"Backstage: Improper input validation in cloud storage URL readers","description":"### Impact\n\nAn attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection.\n\n### Patches\n\nPatched in `@backstage/backend-defaults` version `0.17.8`","state":0,"publishedAt":"2026-10-07T17:59:38+00:00","modifiedAt":"2026-10-07T18:15:12.7776419+00:00","affected":[{"ecosystem":"npm","name":"@backstage/backend-defaults","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.17.8"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/backstage/backstage/security/advisories/GHSA-7649-wm97-w3j3","https://nvd.nist.gov/vuln/detail/CVE-2026-106494","https://github.com/backstage/backstage/commit/14e925ce5b905dd8daa64c3009722febda76034c","https://github.com/backstage/backstage","https://github.com/backstage/backstage/releases/tag/v1.54.6"],"sourceUrl":"https://github.com/advisories/GHSA-7649-wm97-w3j3","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-7649-wm97-w3j3","identifiers":["GHSA-7649-wm97-w3j3","CVE-2026-106494"]},"retained":false,"historicalAffected":[]}],"coverage":[]}