Backstage: Inconsistent enforcement of allowed location types during catalog processing
### Impact Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host. ### Patches Patched in `@backstage/plugin-catalog-backend` version `3.9.1` ### Workarounds No practical workarounds are available. Upgrade to the patched version.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-106496US | medium6.5OT elevated | — | ||
Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent enforcement of allowed loca… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/backstage/backstagePACKAGE
- https://github.com/backstage/backstage/commit/23774b61560d851bc69cd6a77d12561b24d11afdWEB
- https://github.com/backstage/backstage/releases/tag/v1.54.6WEB
- https://github.com/backstage/backstage/security/advisories/GHSA-pcmq-25r3-5w9vWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-106496ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan