CVE-2024-26150

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

`@backstage/backend-common` is a common functionality library for backends for Backstage, an open platform for building developer portals. In `@backstage/backend-common` prior to versions 0.21.1, 0.20.2, and 0.19.10, paths checks with the `resolveSafeChildPath` utility were not exhaustive enough, leading to risk of path traversal vulnerabilities if symlinks can be injected by attackers. This issue is patched in `@backstage/backend-common` versions 0.21.1, 0.20.2, and 0.19.10.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
backstage	backstage	= 0.21.0; < 0.19.10; >= 0.20.0, < 0.20.2

References

Timeline

Published: Feb 23, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-261515.4The `mjml` PyPI package, found at the `FelixSchwarz/mjml-python` GitHub repo, is an unofficial Python port of MJML, a markup language create CVE-2024-261526.1### Summary On all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properly sanitized prior to being ren CVE-2024-261537.4All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.9.19 are vulnerable to cross-site request forgery (CSRF). An external a CVE-2024-261546.1All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting in the appliance si CVE-2024-261558.6All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 expose clear text credentials in the web portal. An attacker can acc CVE-2024-261566.1All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting (XSS) attacks in th CVE-2024-261576.1All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting (XSS) attacks in ge CVE-2024-261587.8Microsoft Install Service Elevation of Privilege Vulnerability CVE-2024-261598.8Microsoft ODBC Driver Remote Code Execution Vulnerability CVE-2024-26162.7To harden ICU against exploitation, the behavior for out-of-memory conditions was changed to crash instead of attempt to continue. This vuln CVE-2024-261605.5Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability CVE-2024-261618.8Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability