https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T23:36:57.437375+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-384060 EUVD-2026-384060 2026-10-17T23:36:57.440080+00:00 EUVD-2026-384060 https://cve.radiocsirt.org/vuln/fkie_cve-2026-106496 fkie_cve-2026-106496 2026-10-17T23:36:57.440145+00:00

Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent enforcement of allowed location types during catalog processing. Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host. This issue is fixed in version 3.9.1.

 https://cve.radiocsirt.org/vuln/ghsa-pcmq-25r3-5w9v GHSA-pcmq-25r3-5w9v — Backstage: Inconsistent enforcement of allowed location types during catalog processing 2026-10-17T23:36:57.440204+00:00

Affected: npm: @backstage/plugin-catalog-backend

### Impact

Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host.

### Patches

Patched in `@backstage/plugin-catalog-backend` version `3.9.1`

### Workarounds

No practical workarounds are available. Upgrade to the patched version.