TI-2024-17240 Aliases CVE-2024-26150 GHSA-2fc9-xpp8-2g9h

`@backstage/backend-common` vulnerable to path traversal through symlinks

LOW 39CWE-22Published 2024-02-23 · Updated 2024-08-01

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · None
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

`@backstage/backend-common` is a common functionality library for backends for Backstage, an open platform for building developer portals. In `@backstage/backend-common` prior to versions 0.21.1, 0.20.2, and 0.19.10, paths checks with the `resolveSafeChildPath` utility were not exhaustive enough, leading to risk of path traversal vulnerabilities if symlinks can be injected by attackers. This issue is patched in `@backstage/backend-common` versions 0.21.1, 0.20.2, and 0.19.10.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00801 56th percentileScored 2026-11-07

Fix Partial backstage (backstage): 0.19.10, 0.20.2@backstage/backend-common (npm): 0.21.1, 0.19.10, 0.20.2Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
backstage	backstage	= 0.21.0; before 0.19.10; 0.20.0 to before 0.20.2	0.19.10, 0.20.2	Patch available	CNA
—	@backstage/backend-common (npm)	0.21.0 to before 0.21.1	0.21.1	Patch available	GHSA-2fc9-xpp8-2g9h
—	@backstage/backend-common (npm)	before 0.19.10	0.19.10	Patch available	GHSA-2fc9-xpp8-2g9h
—	@backstage/backend-common (npm)	0.20.0 to before 0.20.2	0.20.2	Patch available	GHSA-2fc9-xpp8-2g9h

backstage Vendorbackstage Affected = 0.21.0; before 0.19.10; 0.20.0 to before 0.20.2 Fixed in 0.19.10, 0.20.2 Patch available CNA
@backstage/backend-common (npm) Vendor— Affected 0.21.0 to before 0.21.1 Fixed in 0.21.1 Patch available GHSA-2fc9-xpp8-2g9h
@backstage/backend-common (npm) Vendor— Affected before 0.19.10 Fixed in 0.19.10 Patch available GHSA-2fc9-xpp8-2g9h
@backstage/backend-common (npm) Vendor— Affected 0.20.0 to before 0.20.2 Fixed in 0.20.2 Patch available GHSA-2fc9-xpp8-2g9h

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:linuxfoundation:backstage_backend-common::::::node.js::*	before 0.19.10; 0.20.0 to before 0.20.2	Vulnerable	backstage
cpe:2.3:a:linuxfoundation:backstage_backend-common:0.21.0:::::node.js::	0.21.0	Vulnerable	backstage

cpe:2.3:a:linuxfoundation:backstage_backend-common:*:*:*:*:*:node.js:*:* Versions before 0.19.10; 0.20.0 to before 0.20.2 Vulnerable ·backstage
cpe:2.3:a:linuxfoundation:backstage_backend-common:0.21.0:*:*:*:*:node.js:*:* Versions 0.21.0 Vulnerable ·backstage

Remediation

Fix · CNA backstage (backstage) Fixed in 0.19.10, 0.20.2
Fix · GHSA-2fc9-xpp8-2g9h @backstage/backend-common (npm) Fixed in 0.21.1 Advisory →
Fix · GHSA-2fc9-xpp8-2g9h @backstage/backend-common (npm) Fixed in 0.19.10 Advisory →
Fix · GHSA-2fc9-xpp8-2g9h @backstage/backend-common (npm) Fixed in 0.20.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Developer Hub 1	Affected	No fix planned: Will not fix

Not affected: 1 product

Red Hat Developer Hub 1

Timeline

2026-10-02 Threatist record created from CVE-2024-26150
2026-10-03 Alias added: GHSA-2fc9-xpp8-2g9h
2026-10-27 Affected versions changed · Red Hat

References

Patch 3

Advisory 2

Other 1

https://github.com/backstage/backstage

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences