CVE-2024-26150

`@backstage/backend-common` is a common functionality library for backends for Backstage, an open platform for building developer portals. In `@backstage/backend-common` prior to versions 0.21.1, 0.20.2, and 0.19.10, paths checks with the `resolveSafeChildPath` utility were not exhaustive enough, leading to risk of path traversal vulnerabilities if symlinks can be injected by attackers. This issue is patched in `@backstage/backend-common` versions 0.21.1, 0.20.2, and 0.19.10.

• CWE-22
• CWE-22

• https://github.com/backstage/backstage/commit/1ad2b1b61ebb430051f7d804b0cc7ebfe7922b6fPatch
• https://github.com/backstage/backstage/commit/78f892b3a84d63de2ba167928f171154c447b717Patch
• https://github.com/backstage/backstage/commit/edf65d7d31e027599c2415f597d085ee84807871Patch
• https://github.com/backstage/backstage/security/advisories/GHSA-2fc9-xpp8-2g9hVendor Advisory
• https://github.com/backstage/backstage/commit/1ad2b1b61ebb430051f7d804b0cc7ebfe7922b6fPatch
• https://github.com/backstage/backstage/commit/78f892b3a84d63de2ba167928f171154c447b717Patch
• https://github.com/backstage/backstage/commit/edf65d7d31e027599c2415f597d085ee84807871Patch
• https://github.com/backstage/backstage/security/advisories/GHSA-2fc9-xpp8-2g9hVendor Advisory

Published

Feb 23, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-26145Discourse Calendar adds the ability to create a dynamic cale…4.3
• CVE-2024-26146Rack is a modular Ruby web server interface. Carefully craft…7.5
• CVE-2024-26147Helm is a package manager for Charts for Kubernetes. Version…7.5
• CVE-2024-26148Querybook is a user interface for querying big data. Prior t…6.1
• CVE-2024-26149Vyper is a pythonic Smart Contract Language for the ethereum…5.3
• CVE-2024-2615Memory safety bugs present in Firefox 123. Some of these bug…9.8
• CVE-2024-26151The `mjml` PyPI package, found at the `FelixSchwarz/mjml-pyt…5.4
• CVE-2024-26152### Summary On all Label Studio versions prior to 1.11.0, da…6.1
• CVE-2024-26153All versions of ETIC Telecom Remote Access Server (RAS) prio…7.4
• CVE-2024-26154All versions of ETIC Telecom Remote Access Server (RAS) prio…6.1
• CVE-2024-26155All versions of ETIC Telecom Remote Access Server (RAS) prio…8.6
• CVE-2024-26156All versions of ETIC Telecom Remote Access Server (RAS) prio…6.1