CVE-2026-24047: @backstage/cli-common Symlink Chain Bypass Vulnerability
Summary
CVE-2026-24047: @backstage/cli-common has a possible resolveSafeChildPath Symlink Chain Bypass. Affects @backstage/cli-common versions < 0.1.17. Fixed in 0.1.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @backstage/cli-common package is a part of the Backstage ecosystem, which is designed to streamline the development and management of software projects. It provides various utilities and tools to enhance the developer experience. However, it has a vulnerability in its resolveSafeChildPath utility function that can lead to security risks if not addressed.
Vulnerability Detail
The vulnerability in @backstage/cli-common arises from the resolveSafeChildPath function, which is intended to prevent path traversal attacks. It fails to adequately validate symlink chains and dangling symlinks. An attacker can exploit this flaw by creating symlink chains that resolve outside the allowed directory or by using dangling symlinks that point to non-existent paths outside the base directory. This could potentially allow unauthorized file operations within the system, leading to data exposure or manipulation.
How To Fix
Minimum fixed version
0.1.17
This is the first release that contains the fix.
npm install @backstage/cli-common@0.1.17Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider running Backstage in a containerized environment with limited filesystem access. Additionally, restrict template creation to trusted users to minimize the risk of exploitation.
Conclusion
The @backstage/cli-common package contains a vulnerability that could allow attackers to bypass path validation through symlink chains and dangling symlinks. It is crucial for users to upgrade to the patched version to mitigate risks. Implementing workarounds can provide temporary relief until the upgrade is completed.
See every vulnerability recorded for @backstage/cli-common →
FAQ
The vulnerability allows for a possible bypass of path validation through symlink chains and dangling symlinks, which can lead to unauthorized file access.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score for this vulnerability is 6.3, indicating a moderate severity level.
If an immediate upgrade is not possible, implement the suggested workarounds, such as running Backstage in a restricted environment and limiting template creation to trusted users.
Detailed information can be found in the GitHub advisory database and the official documentation for the @backstage/cli-common package.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
