PT-2026-3876 · Netflix · Backstage+1

Rugvip · Published 2026-01-21 · Updated 2026-01-22 · CVE-2026-24047

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.1.17

Description The resolveSafeChildPath utility function in @backstage/backend-plugin-api did not properly validate symlink chains and dangling symlinks, leading to a path traversal issue. An attacker could bypass path validation by creating symlink chains or dangling symlinks that resolve outside the allowed directory. This function is used by Scaffolder actions and other backend components to control file operations within designated directories.

Recommendations Upgrade to version 0.1.17 or later. Run Backstage in a containerized environment with limited filesystem access. Restrict template creation to trusted users.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

CWE-61

Related Identifiers

CVE-2026-24047

GHSA-2P49-45HJ-7MC9

Affected Products

@Backstage/Plugin-App-Backend

Backstage

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24047.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-24047 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24047 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2p49-45hj-7mc9 · Vendor Advisory
• https://github.com/backstage/backstage · Note
• https://github.com/backstage/backstage/security/advisories/GHSA-2p49-45hj-7mc9 · Note
• https://github.com/backstage/backstage/commit/ae4dd5d1572a4f639e1a466fd982656b50f8e692 · Note
• https://twitter.com/VulmonFeeds/status/2014182064602370055 · Twitter Post
• https://t.me/CVEtracker/42709 · Telegram Post
• https://twitter.com/CVEnew/status/2014116176725475808 · Twitter Post