CVE-2026-24047

Backstage is an open framework for building developer portals, and @backstage/cli-common provides config loading functionality used by the backend and command line interface of Backstage. Prior to version 0.1.17, the resolveSafeChildPath utility function in @backstage/backend-plugin-api, which is...

CVE-2026-24047

CVE-2026-24047 affects Backstage: @backstage/cli-common relies on resolveSafeChildPath in @backstage/backend-plugin-api, which before v0.1.17 failed to validate symlink chains and dangling symlinks. This allowed path traversal via symlink chains (e.g., link1 → link2 → /outside) and dangling symli...

@backstage/backend-app-api (>=0.0.0-nightly-20241221023113, <=1.4.0-next.1), @backstage/backend-defaults (>=0.0.0-nightly-20241120023536, <=0.15.0-next.2) +111 more potentially affected by CVE-2026-24047 via @backstage/backend-plugin-api (>=1.0.1, <=1.6.0-next.1)

@backstage/backend-plugin-api NPM version =1.0.1, =0.0.0-nightly-20241221023113, =0.0.0-nightly-20241120023536, =0.0.0-nightly-20241120023536, =0.2.0-next.1, =0.0.0-nightly-20241221023113, =0.0.0-nightly-20241121023535, =0.1.26-next.1, =0.0.0-nightly-20250225023230, =0.3.1-next.1, =0.1.1-next.1,...

@backstage/backend-app-api (>=0.0.0-nightly-20220908030128, <=1.4.0-next.1), @backstage/backend-common (>=0.0.0-nightly-202153022114, <=0.0.0-nightly-20240618021721) +155 more potentially affected by CVE-2026-24047 via @backstage/cli-common (>=0.0.0-nightly-2021612205, <=0.1.16-next.2)

@backstage/cli-common NPM version =0.0.0-nightly-2021612205, =0.0.0-nightly-20220908030128, =0.0.0-nightly-202153022114, =0.0.0-nightly-20220908030128, =0.0.0-nightly-20240116021644, =0.0.0-nightly-20240929023448, =0.0.0-nightly-20220908030128, =0.0.0-nightly-20220908030128,...