Backstage Backend Common
Approved changes feed: RSS · Atom
cpe:2.3:a:linuxfoundation:backstage_backend-common:0.21.0:*:*:*:*:node.js:*:*
part: a version: 0.21.0 update: *
| Vendor | Linuxfoundation (4b459c90-8cdb-5268-beb4-b69b5fe74234) |
|---|---|
| Product | Backstage Backend Common (0774c1c6-cc62-54bf-9edf-828da8552ef5) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | node.js |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/backstage/backstage |
purl2cpe | 2026-06-01 10:13:22.537029 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-26150 |
vulnerable | 2026-06-08 06:31:24.907115 |
`@backstage/backend-common` vulnerable to path traversal through symlinks
HIGH (8.7)
`@backstage/backend-common` is a common functionality library for backends for Backstage, an open platform for building developer portals. In `@backstage/backend-common` prior to versions 0.21.1, 0.20.2, and 0.19.10, paths checks with the `resolveSafeChildPath` utility were not exhaustive enough, leading to risk of path traversal vulnerabilities if symlinks can be injected by attackers. This issue is patched in `@backstage/backend-common` versions 0.21.1, 0.20.2, and 0.19.10.
Published: 2024-02-23T15:46:35.731Z
Updated: 2024-08-01T23:59:32.589Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.