CVE-2024-26150: Path Traversal in @backstage/backend-common

An attacker exploiting this vulnerability could leverage symlinks to traverse outside the intended directory structure and access arbitrary files on the server. This could include sensitive configuration files, source code, or even system files, depending on the server's permissions and the attacker's ability to inject symlinks. Successful exploitation could lead to information disclosure, privilege escalation, or even remote code execution if the attacker can leverage the accessed files to compromise the system. The impact is particularly concerning in environments where Backstage is used to manage critical developer tools and infrastructure.

1. Reserved2024-02-14
2. Published2024-02-23
3. Modified2024-08-01
4. EPSS updated2026-04-02

The primary mitigation is to immediately upgrade @backstage/backend-common to version 0.21.1 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing stricter file access controls and input validation to prevent symlink injection. Review and restrict the permissions of the user account running the Backstage backend to minimize the potential impact of a successful attack. Implement a Web Application Firewall (WAF) with rules to detect and block requests containing suspicious path patterns or symlink attempts. After upgrading, verify the fix by attempting to access files outside the intended directory structure via a web request and confirming that access is denied.