-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from how resolveSafeChildPath handled path resolution. The pre-patch version used resolveRealPath on both base and target but returned the symlink-following targetPath. The commit diff shows the fix changed the return value to avoid following symlinks (via resolvePath instead of realpath), and added tests for non-existent paths. The CWE-22 classification confirms this is a path traversal issue, and the advisory explicitly calls out resolveSafeChildPath as the vulnerable utility. The function's pre-patch behavior failed to properly compare the realpath of both base and target, enabling symlink-based escapes.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @backstage/backend-common | npm | = 0.21.0 | 0.21.1 |
| @backstage/backend-common | npm | < 0.19.10 | 0.19.10 |
| @backstage/backend-common | npm | >= 0.20.0, < 0.20.2 | 0.20.2 |