| Package | Affected versions | Patched versions |
|---|---|---|
| backstage | < 1.54.6 | 1.54.6 |
| backstage plugin-catalog-backend | < 3.9.1 | 3.9.1 |
| @backstage/plugin-catalog-backend | < 3.9.1 | 3.9.1 |
Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host.
Patched in @backstage/plugin-catalog-backend version 3.9.1
No practical workarounds are available. Upgrade to the patched version.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free