Backstage: Inconsistent enforcement of allowed location types during catalog processing
### Impact Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host. ### Patches Patched in `@backstage/plugin-catalog-backend` version `3.9.1` ### Workarounds No practical workarounds are available. Upgrade to the patched version.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-106496US | medium6.5OT erhöht | — | ||
Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent enforcement of allowed loca… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/backstage/backstagePACKAGE
- https://github.com/backstage/backstage/commit/23774b61560d851bc69cd6a77d12561b24d11afdWEB
- https://github.com/backstage/backstage/releases/tag/v1.54.6WEB
- https://github.com/backstage/backstage/security/advisories/GHSA-pcmq-25r3-5w9vWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-106496ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan