The flaw arises from the catalog backend not strictly enforcing the set of permitted location types. When a catalog entry contains a type that should be disallowed, the backend still processes it, which can result in sensitive files on the host being read or written via the request path. Consequently, data that is not intended to be accessed through the catalog can be read or modified, exposing confidential information or corrupting system files. This weakness reflects path traversal, incorrect file permissions, and inconsistent authorization checks.

The affected product is the @backstage/plugin-catalog-backend package of the Backstage framework, including the Backstage distribution itself. Versions of the plugin before 3.9.1 are vulnerable. In Backstage releases that bundle the older plugin, any version prior to v1.54.6 is also impacted until they upgrade to the fixed plugin.

The CVSS base score of 3.1 indicates a low overall severity, and the EPSS score of less than 1% suggests exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog. An attacker would need the ability to inject or modify catalog data that contains disallowed location types or to influence the catalog configuration; from that position they might read or write arbitrary files on the host, but no execution of arbitrary code is provided. Therefore the risk is limited to data disclosure or modification within the backend environment.