GitHub Advisoryadvisory · npm

GHSA-pcmq-25r3-5w9v Backstage: Inconsistent enforcement of allowed location types during catalog processing

LOW Published 2026-10-07 Modified 2026-10-07 Official page ↗
Aliases
CVE-2026-106496
Ecosystem
npm
Packages
@backstage/plugin-catalog-backend
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-22, CWE-863
Reviewed
2026-10-07

Affected packages

• npm @backstage/plugin-catalog-backend: < 3.9.1 → fixed in 3.9.1

Description

Impact Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host. Patches Patched in `@backstage/plugin-catalog-backend` version `3.9.1` Workarounds No practical workarounds are available. Upgrade to the patched version.

Related

Alias · CVE (1)

  • CVE-2026-106496 Backstage is an open framework for building developer portals. vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-863 Incorrect Authorization weakness

References