Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Backstage is an open framework for building developer portals. Prior to version 1.20.1, a vulnerability in the SCM URL parsing used by Backstage integrations allowed path traversal sequences in encoded form to be included in file paths. When these URLs were processed by integration functions that construct API URLs, the traversal segments could redirect requests to unintended SCM provider API endpoints using the configured server-side integration credentials. This issue has been patched in version 1.20.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-29185 Backstage is an open framework for building developer portals. Prior to version 1.20.1, a vulnerability in the SCM URL parsing used by Backstage integrations allowed … https://www.cve.org/CVERecord?id=CVE-2026-29185
Post summary
CVE‑2026‑29185 is a vulnerability in Backstage’s SCM URL parsing logic present before version 1.20.1, as outlined in the CVE record.
CVE-2026-29185 Path Traversal in Backstage SCM Integrations Before Version 1.20.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-29185 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
An announcement of CVE-2026‑29185, a path traversal flaw in Backstage SCM integrations before v1.20.1, with links to vulnerability details and a notification page.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | linuxfoundation | backstage\/integration | - | node.js | - |