What is GHSA-7649-wm97-w3j3?

GHSA-7649-wm97-w3j3 is a security advisory published by GitHub Security Advisories with Medium severity. Backstage: Improper input validation in cloud storage URL readers

Which CVE IDs does GHSA-7649-wm97-w3j3 cover?

GHSA-7649-wm97-w3j3 covers the following CVE IDs: CVE-2026-106494. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7649-wm97-w3j3?

GHSA-7649-wm97-w3j3 has a CVSS v3 base score of 4.4, published by GitHub Security Advisories.

Which products are affected by GHSA-7649-wm97-w3j3?

GHSA-7649-wm97-w3j3 affects 1 product, including: npm/@backstage/backend-defaults:\u003c 0.17.8.

GHSA-7649-wm97-w3j3MediumCVSS 4.4

Backstage: Improper input validation in cloud storage URL readers

Vendor

GitHub Security Advisories

Published

October 7, 2026

Last Modified

October 7, 2026

🔗 CVE IDs covered (1)

CVE-2026-106494 →

📋 Description

Impact

An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection.

Patches

Patched in @backstage/backend-defaults version 0.17.8

🎯 Affected products1

npm/@backstage/backend-defaults:< 0.17.8

🔗 References (5)

https://github.com/backstage/backstage/security/advisories/GHSA-7649-wm97-w3j3
https://nvd.nist.gov/vuln/detail/CVE-2026-106494
https://github.com/backstage/backstage/commit/14e925ce5b905dd8daa64c3009722febda76034c
https://github.com/backstage/backstage/releases/tag/v1.54.6
https://github.com/advisories/GHSA-7649-wm97-w3j3