backstage @backstage/backend-common vulnerabilities

Latest backstage @backstage/backend-common CVEs

Newest publication first

1. CVE-2024-26150 `@backstage/backend-common` vulnerable to path traversal through symlinks

   Published 2024-02-23

   High·CVSS 7.5 EPSS 0.80%

   @backstage/backend-common is a common functionality library for backends for Backstage, an open platform for building developer portals. In @backstage/backend-common prior to versions 0.21.1, 0.20.2, and 0.19.10, paths checks with the resolveSafeChildPath utility were not exhaust...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.