CVE-2026-24047: 
JavaScript vulnerability analysis and mitigation

CVE-2026-24047 is a symlink chain bypass vulnerability in Backstage's @backstage/cli-common (and @backstage/backend-plugin-api) npm packages that allows authenticated attackers to escape designated directory boundaries via crafted symbolic links. The resolveSafeChildPath utility function, designed to prevent path traversal, failed to properly validate symlink chains and dangling symlinks. All versions of @backstage/cli-common up to and including 0.1.16 are affected; the fix is available in version 0.1.17. Disclosed on January 21, 2026, it carries a CVSS v3.1 base score of 6.3 (Medium) (GitHub Advisory, Backstage Advisory).

The root cause is improper link resolution before file access (CWE-59) and UNIX symbolic link following (CWE-61). The resolveSafeChildPath function in @backstage/backend-plugin-api used realpathSync to resolve paths, but this approach failed in two scenarios: (1) symlink chains, where an attacker creates link1 → link2 → /outside, causing intermediate symlinks to resolve outside the allowed directory; and (2) dangling symlinks, where a symlink points to a non-existent path outside the base directory that could be created later during file operations. The fix moves symlink resolution logic into the isChildPath function within @backstage/cli-common, implementing recursive parent-directory walking to properly resolve all symlink hops before performing the boundary check (GitHub Advisory, Patch Commit).

Successful exploitation allows a low-privileged attacker (e.g., a user with template creation rights) to read files outside the designated Backstage workspace directory, resulting in high confidentiality impact with no integrity or availability impact. The scope is marked as Changed, meaning the vulnerability can affect resources beyond the vulnerable component itself — for example, reading sensitive configuration files, secrets, or other data accessible to the Backstage backend process on the host filesystem. This is particularly relevant in multi-tenant developer portal deployments where Scaffolder templates are used to automate file operations (GitHub Advisory, Backstage Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is approximately 0.015–0.025%, indicating a low near-term exploitation probability (GitHub Advisory). Exploitation requires low privileges (e.g., the ability to create Backstage Scaffolder templates) and high attack complexity, limiting the practical attacker pool. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

1. Gain template creation access: Obtain a Backstage account with permissions to create or modify Scaffolder templates (low-privilege user access is sufficient).
2. Craft a malicious template: Create a Scaffolder template that instructs the backend to create symbolic links within the workspace directory. For a symlink chain attack, define actions that create link2 pointing to a sensitive path outside the workspace (e.g., /etc) and link1 pointing to link2.
3. Trigger file operation via symlink chain: Submit the template for execution. The Backstage Scaffolder backend calls resolveSafeChildPath(workspacePath, './link1'), which (in vulnerable versions) resolves only the first hop and fails to detect that the chain ultimately exits the workspace.
4. Read sensitive files: With the path validation bypassed, craft a subsequent template action to read the file at the resolved path (e.g., link1/passwd resolving to /etc/passwd), exfiltrating its contents through template output or logs.
5. Dangling symlink variant: Alternatively, create a symlink within the workspace pointing to a non-existent path outside the base directory (e.g., evil-link → /tmp/secret). The vulnerable resolveSafeChildPath would return the path without error since realpathSync throws ENOENT and falls back to the unresolved path, allowing later file writes or reads at the external location once it is created (GitHub Advisory, Patch Commit).

• File System: Presence of symbolic links within Backstage Scaffolder workspace directories (e.g., /tmp/backstage-* or configured workspace paths) that point to locations outside the workspace, particularly to system directories like /etc, /var, or home directories.
• File System: Symlink chains (e.g., link1 → link2 → /outside) or dangling symlinks pointing to non-existent external paths within workspace directories.
• Logs: Backstage backend logs showing Scaffolder template executions that access or read files from unexpected filesystem paths outside the designated workspace.
• Logs: Errors or unusual file access patterns in Backstage backend logs referencing paths like /etc/, /root/, or other sensitive directories during template execution.
• Process: Backstage backend process (node) performing lstat, readlink, or open syscalls on paths outside the expected workspace directory (detectable via auditd or eBPF-based monitoring).

Upgrade @backstage/cli-common to version 0.1.17 or later, and @backstage/backend-plugin-api to the corresponding patched version, as the fix is delivered in both packages (GitHub Advisory, Patch Commit). If immediate upgrade is not possible, two workarounds are available: (1) run Backstage in a containerized environment with limited filesystem access (e.g., using Docker with restricted volume mounts), and (2) restrict Scaffolder template creation to trusted users only, reducing the attacker pool (Backstage Advisory).

The advisory was published by Backstage maintainer Rugvip on January 21, 2026, and received standard community distribution through GitHub Advisory Database and vulnerability aggregators. No notable independent researcher commentary, media coverage, or significant social media discussion beyond automated CVE tracking posts has been identified for this vulnerability.