| Package | Affected versions | Patched versions |
|---|---|---|
| backstage backend-common | = 0.21.0≥ 0.20.0, < 0.20.2< 0.19.10 | 0.20.20.19.10 |
| @backstage/backend-common | ≥ 0.20.0, < 0.20.2≥ 0.21.0, < 0.21.1< 0.19.10 | 0.20.20.21.10.19.10 |
Paths checks with the resolveSafeChildPath utility were not exhaustive enough, leading to risk of path traversal vulnerabilities if symlinks can be injected by attackers.
Patched in @backstage/backend-common version 0.21.1.
Patched in @backstage/backend-common version 0.20.2.
Patched in @backstage/backend-common version 0.19.10.
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free