CVE-2026-24047

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24047", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-20T22:30:11.778Z", "datePublished": "2026-01-21T22:45:06.956Z", "dateUpdated": "2026-01-22T16:49:06.720Z"}, "containers": {"cna": {"title": "@backstage/cli-common has a possible `resolveSafeChildPath` Symlink Chain Bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-59", "lang": "en", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-61", "lang": "en", "description": "CWE-61: UNIX Symbolic Link (Symlink) Following", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/backstage/backstage/security/advisories/GHSA-2p49-45hj-7mc9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/backstage/backstage/security/advisories/GHSA-2p49-45hj-7mc9"}, {"name": "https://github.com/backstage/backstage/commit/ae4dd5d1572a4f639e1a466fd982656b50f8e692", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/commit/ae4dd5d1572a4f639e1a466fd982656b50f8e692"}], "affected": [{"vendor": "backstage", "product": "backstage", "versions": [{"version": "< 0.1.17", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-21T22:45:06.956Z"}, "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals, and @backstage/cli-common provides config loading functionality used by the backend and command line interface of Backstage. Prior to version 0.1.17, the `resolveSafeChildPath` utility function in `@backstage/backend-plugin-api`, which is used to prevent path traversal attacks, failed to properly validate symlink chains and dangling symlinks. An attacker could bypass the path validation via symlink chains (creating `link1 \u2192 link2 \u2192 /outside` where intermediate symlinks eventually resolve outside the allowed directory) and dangling symlinks (creating symlinks pointing to non-existent paths outside the base directory, which would later be created during file operations). This function is used by Scaffolder actions and other backend components to ensure file operations stay within designated directories. This vulnerability is fixed in `@backstage/backend-plugin-api` version 0.1.17. Users should upgrade to this version or later. Some workarounds are available. Run Backstage in a containerized environment with limited filesystem access and/or restrict template creation to trusted users."}], "source": {"advisory": "GHSA-2p49-45hj-7mc9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-22T15:09:18.960475Z", "id": "CVE-2026-24047", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T16:49:06.720Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24047", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-22T15:09:18.960475Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T15:09:20.508Z"}}], "cna": {"title": "@backstage/cli-common has a possible `resolveSafeChildPath` Symlink Chain Bypass", "source": {"advisory": "GHSA-2p49-45hj-7mc9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "backstage", "product": "backstage", "versions": [{"status": "affected", "version": "< 0.1.17"}]}], "references": [{"url": "https://github.com/backstage/backstage/security/advisories/GHSA-2p49-45hj-7mc9", "name": "https://github.com/backstage/backstage/security/advisories/GHSA-2p49-45hj-7mc9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/backstage/backstage/commit/ae4dd5d1572a4f639e1a466fd982656b50f8e692", "name": "https://github.com/backstage/backstage/commit/ae4dd5d1572a4f639e1a466fd982656b50f8e692", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals, and @backstage/cli-common provides config loading functionality used by the backend and command line interface of Backstage. Prior to version 0.1.17, the `resolveSafeChildPath` utility function in `@backstage/backend-plugin-api`, which is used to prevent path traversal attacks, failed to properly validate symlink chains and dangling symlinks. An attacker could bypass the path validation via symlink chains (creating `link1 \u2192 link2 \u2192 /outside` where intermediate symlinks eventually resolve outside the allowed directory) and dangling symlinks (creating symlinks pointing to non-existent paths outside the base directory, which would later be created during file operations). This function is used by Scaffolder actions and other backend components to ensure file operations stay within designated directories. This vulnerability is fixed in `@backstage/backend-plugin-api` version 0.1.17. Users should upgrade to this version or later. Some workarounds are available. Run Backstage in a containerized environment with limited filesystem access and/or restrict template creation to trusted users."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-61", "description": "CWE-61: UNIX Symbolic Link (Symlink) Following"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-21T22:45:06.956Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24047", "state": "PUBLISHED", "dateUpdated": "2026-01-22T16:49:06.720Z", "dateReserved": "2026-01-20T22:30:11.778Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-21T22:45:06.956Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "backstage", "vendor": "backstage", "versions": [{"status": "affected", "version": "< 0.1.17"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals, and @backstage/cli-common provides config loading functionality used by the backend and command line interface of Backstage. Prior to version 0.1.17, the `resolveSafeChildPath` utility function in `@backstage/backend-plugin-api`, which is used to prevent path traversal attacks, failed to properly validate symlink chains and dangling symlinks. An attacker could bypass the path validation via symlink chains (creating `link1 \u2192 link2 \u2192 /outside` where intermediate symlinks eventually resolve outside the allowed directory) and dangling symlinks (creating symlinks pointing to non-existent paths outside the base directory, which would later be created during file operations). This function is used by Scaffolder actions and other backend components to ensure file operations stay within designated directories. This vulnerability is fixed in `@backstage/backend-plugin-api` version 0.1.17. Users should upgrade to this version or later. Some workarounds are available. Run Backstage in a containerized environment with limited filesystem access and/or restrict template creation to trusted users."}, {"lang": "es", "value": "Backstage es un framework abierto para construir portales de desarrollador, y @backstage/cli-common proporciona funcionalidad de carga de configuraci\u00f3n utilizada por el backend y la interfaz de l\u00ednea de comandos de Backstage. Antes de la versi\u00f3n 0.1.17, la funci\u00f3n de utilidad 'resolveSafeChildPath' en '@backstage/backend-plugin-api', que se utiliza para prevenir ataques de salto de ruta, no validaba correctamente las cadenas de enlaces simb\u00f3licos y los enlaces simb\u00f3licos colgantes. Un atacante podr\u00eda eludir la validaci\u00f3n de ruta a trav\u00e9s de cadenas de enlaces simb\u00f3licos (creando 'link1 ? link2 ? /outside' donde los enlaces simb\u00f3licos intermedios finalmente se resuelven fuera del directorio permitido) y enlaces simb\u00f3licos colgantes (creando enlaces simb\u00f3licos que apuntan a rutas inexistentes fuera del directorio base, que luego se crear\u00edan durante las operaciones de archivo). Esta funci\u00f3n es utilizada por las acciones de Scaffolder y otros componentes de backend para asegurar que las operaciones de archivo permanezcan dentro de los directorios designados. Esta vulnerabilidad se corrige en '@backstage/backend-plugin-api' versi\u00f3n 0.1.17. Los usuarios deben actualizar a esta versi\u00f3n o posterior. Hay disponibles algunas soluciones alternativas. Ejecute Backstage en un entorno en contenedores con acceso limitado al sistema de archivos y/o restrinja la creaci\u00f3n de plantillas a usuarios de confianza."}], "id": "CVE-2026-24047", "lastModified": "2026-06-17T10:22:31.057", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24047", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-22T15:09:18.960475Z", "version": "2.0.3"}}]}, "published": "2026-01-21T23:15:53.407", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/backstage/backstage/commit/ae4dd5d1572a4f639e1a466fd982656b50f8e692"}, {"source": "security-advisories@github.com", "url": "https://github.com/backstage/backstage/security/advisories/GHSA-2p49-45hj-7mc9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}, {"lang": "en", "value": "CWE-61"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "@backstage/backend-plugin-api: @backstage/cli-common Symlink Chain Bypass", "id": "2431880", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431880"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "status": "draft"}, "cwe": "(CWE-59|CWE-61)", "details": ["Backstage is an open framework for building developer portals, and @backstage/cli-common provides config loading functionality used by the backend and command line interface of Backstage. Prior to version 0.1.17, the `resolveSafeChildPath` utility function in `@backstage/backend-plugin-api`, which is used to prevent path traversal attacks, failed to properly validate symlink chains and dangling symlinks. An attacker could bypass the path validation via symlink chains (creating `link1 \u2192 link2 \u2192 /outside` where intermediate symlinks eventually resolve outside the allowed directory) and dangling symlinks (creating symlinks pointing to non-existent paths outside the base directory, which would later be created during file operations). This function is used by Scaffolder actions and other backend components to ensure file operations stay within designated directories. This vulnerability is fixed in `@backstage/backend-plugin-api` version 0.1.17. Users should upgrade to this version or later. Some workarounds are available. Run Backstage in a containerized environment with limited filesystem access and/or restrict template creation to trusted users."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-24047", "package_state": [{"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Fix deferred", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub"}], "public_date": "2026-01-21T22:45:06Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-24047\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-24047\nhttps://github.com/backstage/backstage/commit/ae4dd5d1572a4f639e1a466fd982656b50f8e692\nhttps://github.com/backstage/backstage/security/advisories/GHSA-2p49-45hj-7mc9"], "threat_severity": "Moderate"}

{"analysis": {"en": {"generated_at": "2026-04-18T04:04:52.837543+00:00", "value": {"mitigation_remediation": ["Upgrade the @backstage/backend-plugin-api package to version 0.1.17 or later, ensuring that resolveSafeChildPath contains the patch.", "Restrict template creation and file manipulation interfaces to trusted users or roles, preventing untrusted users from providing symlink chains that target sensitive paths.", "Deploy Backstage within a container or virtualized environment that limits filesystem access, restricting the backend's exposure to critical directories outside the application data folder."], "summary": {"action": "Immediate Patch", "impact": "Directory Traversal via Symlink Chain"}, "threat_synthesis": {"affected_systems": "Backstage, an open\u2011source framework for developer portals, is affected. Specifically, the @backstage/cli-common package and the @backstage/backend-plugin-api component under the backstage:backstage vendor. Versions of @backstage/backend-plugin-api older than 0.1.17 contain the flaw. Users deploying Backstage before that release should review their installed package versions. No other product variants are presently documented in the CNA data.", "description_and_impact": "The vulnerability resides in the resolveSafeChildPath utility used by the @backstage/backend-plugin-api. Before version 0.1.17 this function does not fully validate symlink chains or dangling symlinks, allowing an attacker to craft a chain of symbolic links that finally resolve to a path outside of the intended base directory. This bypass permits reading or writing arbitrary files on the host filesystem when paths processed by tools such as Scaffolder actions are resolved. The weakness is categorized as CWE\u201159 (Improper Handling of Relative Pathname) and CWE\u201161 (Improper Restriction of Operations within the File System). The direct impact is that a privileged or compromised user can gain file system access beyond the designated sandbox, potentially leading to data exfiltration or configuration manipulation.", "risk_and_exploitability": "The CVSS base score of 6.3 indicates a moderate severity. The EPSS score is less than 1 percent, reflecting a very low probability of exploitation under current threat data. The vulnerability is not listed in the CISA KEV catalog, and no known active exploits are publicly reported. Exploitation requires the attacker to supply a controlled symlink chain to the resolveSafeChildPath routine, which is generally limited to the context of template creation, file uploads, or local file handling by the Backstage backend. Therefore the attack surface is constrained to environments where an attacker can influence file system operations, such as an untrusted user with the ability to submit templates or an application running with elevated permissions. In absence of such an avenue, the risk remains low to moderate."}}}}, "created": "2026-01-22T10:08:22.154458+00:00", "updated": "2026-04-18T04:15:05.870785+00:00", "vendors": ["backstage", "backstage$PRODUCT$backstage"]}