Backstage, a developer portal framework, validates catalog location URLs against configured catalog.rules. An authenticated user with catalog.location.create permission can bypass this validation by using percent-encoded path segments that, when canonicalized, point to untrusted locations. This allows entity content from an untrusted source to be considered trusted, potentially leading to unauthorized data inclusion or code execution, depending on how the system consumes such content. The weakness is a path traversal condition (CWE-22).

Vendors: Backstage. Products affected: @backstage/plugin-catalog-backend in versions prior to 3.9.2 and from 4.0.0 through 4.0.2. Those running earlier releases, including 3.8.x and 4.0.0–4.0.2, are vulnerable; the issue is resolved in 3.9.2 and 4.0.2.

The CVSS score of 6.5 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Anticipated attack likely requires the user to have catalog.location.create rights; an attacker with such permission can craft URLs to bypass validation. If the deployment prints or executes the fetched content, further compromise could occur. The vulnerability is not publicly catalogued as exploited, but the missing EPSS data limits current exploitation probability assessment.