CVE-2026-106496

Summary

Backstage: Inconsistent enforcement of allowed location types during catalog processing

Severity

low

CVSS

3.1

EPSS

0.2% (p15)

CWE

CWE-22, CWE-863

Also known as

GHSA-pcmq-25r3-5w9v

Published

2026-10-07

Updated

2026-10-07

Advisory details

Impact

Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host.

Patches

Patched in @backstage/plugin-catalog-backend version 3.9.1

Workarounds

No practical workarounds are available. Upgrade to the patched version.

References

• https://github.com/advisories/GHSA-pcmq-25r3-5w9v
• https://github.com/backstage/backstage/security/advisories/GHSA-pcmq-25r3-5w9v
• https://nvd.nist.gov/vuln/detail/CVE-2026-106496
• https://github.com/backstage/backstage/commit/23774b61560d851bc69cd6a77d12561b24d11afd
• https://github.com/backstage/backstage/releases/tag/v1.54.6

Related advisories

• CVE-2026-106498 — high · npm/@backstage/plugin-catalog-backend
• CVE-2026-86439 — high · npm/knowns
• CVE-2026-92945 — medium · npm/vm2
• GHSA-cxf3-9h37-7rr8#github.com/labstack/echo/v5 — critical · Go/github.com/labstack/echo/v5
• GHSA-cxf3-9h37-7rr8#github.com/labstack/echo/v4 — critical · Go/github.com/labstack/echo/v4
• CVE-2026-77366 — critical · npm/obsidian-tc
• CVE-2026-114125 — critical · npm/storybook
• CVE-2026-77459 — critical · Go/github.com/argoproj/argo-cd/v2

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity