Executive brief
The Backstage Scaffolder tool uses a path validation function to prevent users from accessing files outside of their designated project directories. An attacker with low privileges could bypass this protection by creating symlink chains or dangling symlinks pointing to sensitive files outside the sandbox, allowing unauthorized file read access to restricted areas of the system.
Technical details
The `resolveSafeChildPath` utility function in @backstage/cli-common, which is used to prevent path traversal attacks, failed to properly validate symlink chains and dangling symlinks. An attacker could bypass the path validation through two mechanisms: (1) symlink chains where link1 → link2 → /outside resolves outside the allowed directory through intermediate symlinks, and (2) dangling symlinks pointing to non-existent paths outside the base directory that would be created during subsequent file operations. This function is used by Scaffolder actions and other backend components to ensure file operations stay within designated directories. The vulnerability requires low privileges and network access; no user interaction is required, but attack complexity is high. Exploitation allows reading of files outside the intended scope. The vulnerability is fixed in @backstage/backend-plugin-api version 0.1.17 and @backstage/cli-common with corresponding patches.
Affected products
- Backstage @backstage/cli-common <= 0.1.16
- Backstage @backstage/backend-plugin-api < 0.1.17
Timeline
- 2026-01-21: disclosed: Advisory published
- 2026-01-21: patched: Fix released in @backstage/backend-plugin-api 0.1.17 and @backstage/cli-common with patch versions