6.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24047

CVE-2026-24047: @backstage/cli-common has a possible `resolveSafeChildPath` Symlink Chain Bypass

Backstage is an open framework for building developer portals, and @backstage/cli-common provides config loading functionality used by the backend and command line interface of Backstage. Prior to version 0.1.17, the resolveSafeChildPath utility function in @backstage/backend-plugin-api, which is used to prevent path traversal attacks, failed to properly validate symlink chains and dangling symlinks. An attacker could bypass the path validation via symlink chains (creating link1 → link2 → /outside where intermediate symlinks eventually resolve outside the allowed directory) and dangling symlinks (creating symlinks pointing to non-existent paths outside the base directory, which would later be created during file operations). This function is used by Scaffolder actions and other backend components to ensure file operations stay within designated directories. This vulnerability is fixed in @backstage/backend-plugin-api version 0.1.17. Users should upgrade to this version or later. Some workarounds are available. Run Backstage in a containerized environment with limited filesystem access and/or restrict template creation to trusted users.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24047

CVE-2026-24047:

6.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@backstage/cli-common	npm	<= 0.1.16	0.1.17

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the resolveSafeChildPath function, which is responsible for ensuring that file paths resolve to a location within a specified base directory. The root cause was an insecure implementation of path resolution that failed to properly handle symbolic link (symlink) chains and dangling symlinks.

The vulnerability stemmed from the resolveRealPath helper function within packages/backend-plugin-api/src/paths.ts. This function would try to resolve a path using fs.realpathSync, but if the path didn't exist, it would silently return the original, unresolved path. An attacker could exploit this by creating a symlink that pointed to a non-existent file outside the safe directory. When resolveSafeChildPath was called with this symlink, the flawed resolveRealPath would fail to resolve it and return the symlink path itself, which isChildPath would then incorrectly approve.

The patch addresses this by completely removing the insecure resolveRealPath function from packages/backend-plugin-api/src/paths.ts and shifting the responsibility of path resolution to the isChildPath function in @backstage/cli-common. A new, more robust resolveRealPath function was introduced in packages/cli-common/src/isChildPath.ts. This new function correctly handles symlink chains and dangling symlinks by recursively resolving symlink targets and walking up the directory tree to resolve paths even when parts of the path do not yet exist. By ensuring all paths are fully and securely resolved before comparison, the patch effectively closes the path traversal vulnerability.

Vulnerable functions

resolveSafeChildPath

packages/backend-plugin-api/src/paths.ts

This function was the main entry point for the vulnerable path resolution logic. Before the patch, it used a flawed `resolveRealPath` function that did not properly handle symlink chains or dangling symlinks. An attacker could provide a specially crafted path that would bypass the security check in `isChildPath`, allowing file operations outside the intended base directory.

isChildPath

packages/cli-common/src/isChildPath.ts

Prior to the patch, this function was implicitly vulnerable as it did not perform any path resolution itself. It trusted that the paths provided by its caller (`resolveSafeChildPath`) were already safely resolved. The vulnerability was that this trust was misplaced. The patch moves the responsibility of resolving symlinks into this function, making it secure.

resolveRealPath

packages/backend-plugin-api/src/paths.ts

This function, which was removed by the patch, contained the core flawed logic. It would attempt to resolve a path but would simply return the original path if the target did not exist (ENOENT). This behavior allowed an attacker to use a dangling symlink (a symlink pointing to a non-existent location) to bypass the path traversal checks, as the unresolved malicious path would be passed to the `isChildPath` function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.