CVE-2026-115923 with a CVSS score of 6.5 is a path traversal weakness in the Backstage catalog backend component, specifically @backstage/plugin-catalog-backend, where URL-type catalog locations are evaluated against catalog.rules location patterns using the raw user-supplied URL string while URL readers later resolve the same target in canonical form. The affected versions are '@backstage/plugin-catalog-backend (npm) versions < 3.9.2' and '@backstage/plugin-catalog-backend (npm) versions >= 4.0.0, < 4.0.2'. An authenticated network attacker who has the catalog.location.create permission can register a crafted URL location containing percent-encoded dot segments, such as an encoded path that appears to match a trusted prefix during rule enforcement but resolves to a different, untrusted path when content is fetched. This allows entity content from outside the operator-configured trusted location scope to be ingested as if it were inside that scope. The business impact is a bypass of catalog ingestion policy, potentially allowing untrusted catalog entities to enter the deployment and trigger downstream actions performed by processors or scaffolder with integration credentials, depending on configuration.
We recommend you to update @backstage/plugin-catalog-backend to version 3.9.2, 4.0.2, or Backstage release 1.54.10, 1.56.1 depending on your installed branch.[/subscribe_to_unlock_form]
CVE-2026-115923 with a CVSS score of 6.5 is a path traversal weakness in the Backstage catalog backend component, specifically @backstage/plugin-catalog-backend, where URL-type catalog locations are evaluated against catalog.rules location patterns using the raw user-supplied URL string while URL readers later resolve the same target in canonical form. The affected versions are '@backstage/plugin-catalog-backend (npm) versions < 3.9.2' and '@backstage/plugin-catalog-backend (npm) versions >= 4.0.0, < 4.0.2'. An authenticated network attacker who has the catalog.location.create permission can register a crafted URL location containing percent-encoded dot segments, such as an encoded path that appears to match a trusted prefix during rule enforcement but resolves to a different, untrusted path when content is fetched. This allows entity content from outside the operator-configured trusted location scope to be ingested as if it were inside that scope. The business impact is a bypass of catalog ingestion policy, potentially allowing untrusted catalog entities to enter the deployment and trigger downstream actions performed by processors or scaffolder with integration credentials, depending on configuration.
We recommend you to update @backstage/plugin-catalog-backend to version 3.9.2, 4.0.2, or Backstage release 1.54.10, 1.56.1 depending on your installed branch.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]