Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-106496 · GHSA-pcmq-25r3-5w9v

Backstage: Inconsistent enforcement of allowed location types during catalog processing

Risk score
47/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.2%
Published
6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent enforcement of allowed location types during catalog processing. Under certain configurations, the catalog backend could process location types that were not intended…
Affected
@backstage/plugin-catalog-backend (npm) < 3.9.1
Fix
Upgrade @backstage/plugin-catalog-backend to 3.9.1 or later.
Exploitation
No known exploitation

Story map

Story map: @backstage/plugin-catalog-backendTHE FLAWSTHE FIXCVE-2026-106496Backstage: Inconsistentenforcement of allowedlocation types during catalog…CVSS 6.5 · EPSS 0%CVE-2026-106498Backstage: Improper URLvalidation in catalog entityplaceholder resolutionCVSS 7.7 · EPSS 0%Upgrade…3.9.1 · 3.5.1 · 3.6.2 · 3.7.2 ·3.8.2or later on your release lineWho is exposed@backstage/plugin-catalog-backend (npm) < 3.9.1YELLOW · PLAN IT IN@backstage/plugin-catalog-backe…Backstage is an open frameworkfor building developer portals.Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2and 3.9.1, the@backstage/plugin-catalog-backend package is affected byimproper url validation in…Where it standsNo known exploitationCONNECTS TOSame weaknessPath traversal (CWE-22)399 other warnings in 30 days →Same productEarlier @backstage/plugin-catalog-backend warnings1 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

@backstage/plugin-catalog-backend: Yellow, plan it in. Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backstage/plugin-catalog-backend package is affected by improper url validation in catalog entity placeholder resolution. An authenticated Backstage user could craft a catalog entity with placeholder dire…

The flaws

  • CVE-2026-106496: Backstage: Inconsistent enforcement of allowed location types during catalog processing (CVSS 6.5 · EPSS 0%)
  • CVE-2026-106498: Backstage: Improper URL validation in catalog entity placeholder resolution (CVSS 7.7 · EPSS 0%)

The fix

Upgrade @backstage/plugin-catalog-backend: 3.9.1 · 3.5.1 · 3.6.2 · 3.7.2 · 3.8.2 or later on your release line

Who is exposed: @backstage/plugin-catalog-backend (npm) < 3.9.1

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 6.5 medium
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
@backstage/plugin-catalog-backendnpm< 3.9.13.9.1

References

Original description

Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent enforcement of allowed location types during catalog processing. Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host. This issue is fixed in version 3.9.1.

Last activity 6 Oct 2026. Patch Forecast updates every hour.