Security readout for executives and security teams
Plain-English summary
Backstage sites using the affected path-safety utility may let a low-privileged user escape intended working directories through crafted symlinks. The main concern is unauthorized reading of files outside approved directories, especially through Scaffolder or backend file operations. Public sources rate this medium severity and do not report active exploitation.
Executive priority
Treat as a prioritized routine fix for Backstage environments, especially developer portals with broad template access. It is not currently evidenced as exploited, but it can expose sensitive files if abused. Upgrade during the next appropriate maintenance window, sooner for internet-accessible or multi-team deployments.
Technical view
Before @backstage/backend-plugin-api 0.1.17, resolveSafeChildPath did not properly validate symlink chains or dangling symlinks. A user able to influence relevant file operations could bypass path containment checks and reach paths outside the base directory. CVSS 3.1 is 6.3: AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N.
Likely exposure
Exposure is most relevant for Backstage deployments using vulnerable @backstage/backend-plugin-api versions and Scaffolder actions or backend components that rely on resolveSafeChildPath for filesystem containment. Risk increases where template creation or relevant backend workflows are available to untrusted or broadly privileged users.
Exploitation context
The advisory describes bypasses using symlink chains and dangling symlinks. Exploitation requires privileges to create or influence the relevant files or templates, and attack complexity is rated high. No CISA KEV listing or source-provided evidence of active exploitation was included.
Researcher notes
The public record names CWE-59 and CWE-61, covering link-following and UNIX symbolic link issues. The fix is linked in the Backstage repository. Evidence is limited to the CVE record, GitHub advisory, and commit; no exploit availability or real-world abuse is stated in provided sources.
Mitigation direction
- Upgrade @backstage/backend-plugin-api to version 0.1.17 or later.
- Restrict template creation and relevant Scaffolder capabilities to trusted users.
- Run Backstage in a containerized environment with limited filesystem access.
- Review the GitHub advisory for any additional vendor workarounds.
Validation and detection
- Inventory Backstage deployments and package versions for @backstage/backend-plugin-api.
- Identify Scaffolder actions and backend components using resolveSafeChildPath.
- Review who can create templates or influence backend file operations.
- Confirm deployed package version is 0.1.17 or later after remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-59: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-61: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-24047 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N1.84Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.3MediumVector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/backstage/backstage/security/advisories/GHSA-2p49-45hj-7mc9CVE reference · x_refsource_CONFIRM
- https://github.com/backstage/backstage/commit/ae4dd5d1572a4f639e1a466fd982656b50f8e692CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Link Resolution Before File Access ('Link Following')
Improper Link Resolution Before File Access ('Link Following') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
UNIX Symbolic Link (Symlink) Following
UNIX Symbolic Link (Symlink) Following represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.