What is the CVSS score of CVE-2026-29185?

CVE-2026-29185 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Backstage Integration are affected by CVE-2026-29185?

CVE-2026-29185 is a low-severity vulnerability in Backstage involving path traversal (CVSS 2.7).. A patch is available.

How to fix or mitigate CVE-2026-29185?

During next maintenance window: Apply vendor patches when convenient. Verify path traversal controls are in place.

Backstage Integration CVE-2026-29185

LOW

Path Traversal (CWE-22)

2026-03-07 security-advisories@github.com

GHSA-95v5-prp4-5gv5

Path Traversal Backstage Integration

2.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 07, 2026 - 15:15 nvd

LOW 2.7

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1,180 npm packages depend on @backstage/integration (198 direct, 1,032 indirect)

Ecosystem-wide dependent count for version 1.20.1.

DescriptionGitHub Advisory

Backstage is an open framework for building developer portals. Prior to version 1.20.1, a vulnerability in the SCM URL parsing used by Backstage integrations allowed path traversal sequences in encoded form to be included in file paths. When these URLs were processed by integration functions that construct API URLs, the traversal segments could redirect requests to unintended SCM provider API endpoints using the configured server-side integration credentials. This issue has been patched in version 1.20.1.

AnalysisAI

Technical ContextAI

This vulnerability (CWE-22: Path Traversal) affects Backstage is an open framework for building developer portals.. Backstage is an open framework for building developer portals. Prior to version 1.20.1, a vulnerability in the SCM URL parsing used by Backstage integrations allowed path traversal sequences in encoded form to be included in file paths. When these URLs were processed by integration functions that construct API URLs, the traversal segments could redirect requests to unintended SCM provider API endpoints using the configured server-side integration credentials. This issue has been patched in versi