GHSA-pcmq-25r3-5w9v
Backstage: Inconsistent enforcement of allowed location types during catalog processing
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @backstage/plugin-catalog-backend | < 3.9.1 | 3.9.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host.
### Patches
Patched in `@backstage/plugin-catalog-backend` version `3.9.1`
### Workarounds
No practical workarounds are available. Upgrade to the patched version.
References
External links from the advisory. They lead to third-party sites.
- https://github.com/backstage/backstage/security/advisories/GHSA-pcmq-25r3-5w9v
- https://nvd.nist.gov/vuln/detail/CVE-2026-106496
- https://github.com/backstage/backstage/commit/23774b61560d851bc69cd6a77d12561b24d11afd
- https://github.com/backstage/backstage
- https://github.com/backstage/backstage/releases/tag/v1.54.6