Path Traversal Vulnerability in Backstage Framework by Backstage
CVE-2026-24047

6.3MEDIUM

Key Information:

Vendor

Backstage

Status
Backstage
Vendor
CVE Published:
21 January 2026

What is CVE-2026-24047?

The Backstage framework, used for building developer portals, has a vulnerability in the @backstage/backend-plugin-api component. The resolveSafeChildPath function, responsible for path validation, does not adequately check symlink chains and dangling symlinks prior to version 0.1.17. This oversight allows attackers to potentially bypass security measures, making it feasible to direct file operations outside designated directories through crafted symlink constructs. To mitigate this issue, it is recommended that users upgrade to version 0.1.17 or later. Temporary workarounds include running Backstage in a containerized environment with restricted filesystem access and limiting template creation permissions.

Affected Version(s)

backstage < 0.1.17

References

https://github.com/backstage/backstage/security/advisorie...
x_refsource_CONFIRM
https://github.com/backstage/backstage/commit/ae4dd5d1572...
x_refsource_MISC

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.