What is GHSA-pcmq-25r3-5w9v?

GHSA-pcmq-25r3-5w9v is a security advisory published by GitHub Security Advisories with Low severity. Backstage: Inconsistent enforcement of allowed location types during catalog processing

Which CVE IDs does GHSA-pcmq-25r3-5w9v cover?

GHSA-pcmq-25r3-5w9v covers the following CVE IDs: CVE-2026-106496. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-pcmq-25r3-5w9v?

GHSA-pcmq-25r3-5w9v has a CVSS v3 base score of 3.1, published by GitHub Security Advisories.

Which products are affected by GHSA-pcmq-25r3-5w9v?

GHSA-pcmq-25r3-5w9v affects 1 product, including: npm/@backstage/plugin-catalog-backend:\u003c 3.9.1.

GHSA-pcmq-25r3-5w9vLowCVSS 3.1

Backstage: Inconsistent enforcement of allowed location types during catalog processing

Vendor

GitHub Security Advisories

Published

October 7, 2026

Last Modified

October 7, 2026

🔗 CVE IDs covered (1)

CVE-2026-106496 →

📋 Description

Impact

Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host.

Patches

Patched in @backstage/plugin-catalog-backend version 3.9.1

Workarounds

No practical workarounds are available. Upgrade to the patched version.

🎯 Affected products1

npm/@backstage/plugin-catalog-backend:< 3.9.1

🔗 References (5)

https://github.com/backstage/backstage/security/advisories/GHSA-pcmq-25r3-5w9v
https://nvd.nist.gov/vuln/detail/CVE-2026-106496
https://github.com/backstage/backstage/commit/23774b61560d851bc69cd6a77d12561b24d11afd
https://github.com/backstage/backstage/releases/tag/v1.54.6
https://github.com/advisories/GHSA-pcmq-25r3-5w9v