Loading HuntDB...

GHSA-2fc9-xpp8-2g9h

GitHub Security Advisory

`@backstage/backend-common` vulnerable to path traversal through symlinks

✓ GitHub Reviewed HIGH Has CVE

Advisory Details

### Impact

Paths checks with the `resolveSafeChildPath` utility were not exhaustive enough, leading to risk of path traversal vulnerabilities if symlinks can be injected by attackers.

### Patches
Patched in `@backstage/backend-common` version `0.21.1`.
Patched in `@backstage/backend-common` version `0.20.2`.
Patched in `@backstage/backend-common` version `0.19.10`.

### For more information
If you have any questions or comments about this advisory:

- Open an issue in the [Backstage repository](https://github.com/backstage/backstage)
- Visit our Discord, linked to in [Backstage README](https://github.com/backstage/backstage)

Affected Packages

npm @backstage/backend-common
Affected versions: 0.21.0 (fixed in 0.21.1)
npm @backstage/backend-common
Affected versions: 0 (fixed in 0.19.10)
npm @backstage/backend-common
Affected versions: 0.20.0 (fixed in 0.20.2)

Related CVEs

Key Information

GHSA ID
GHSA-2fc9-xpp8-2g9h
Published
February 23, 2024 6:02 PM
Last Modified
February 23, 2024 7:43 PM
CVSS Score
7.5 /10
Primary Ecosystem
npm
Primary Package
@backstage/backend-common
GitHub Reviewed
✓ Yes

Dataset

Last updated: July 12, 2025 6:29 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.