CVE-2026-106498highCWE-863 CWE-918

CVE-2026-106498: fallo de gravedad alta en backstage

Backstage: Improper URL validation in catalog entity placeholder resolution

Publicada el 06 oct 2026

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.7epss 0.3%

probabilidad de explotación

0.3%top 78% de las CVE

explotación observada

noninguna fuente lo reporta

Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backstage/plugin-catalog-backend package is affected by improper url validation in catalog entity placeholder resolution. An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user. This issue is fixed in versions 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Productos afectados

@backstage · plugin-catalog-backend backstage · backstage

CVEs relacionadas — backstage

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-35926HIGHInsecure sandbox in Backstage Scaffolder pluginEPSS 1.9%CVE-2021-41151MEDIUMPath Traversal in @backstage/plugin-scaffolder-backendEPSS 1.3%CVE-2021-32662MEDIUMTechDocs mkdocs.yml path traversalEPSS 1.3%CVE-2021-32660MEDIUMTechDocs content sanitization bypassEPSS 1.3%CVE-2021-43783HIGHPath Traversal in @backstage/plugin-scaffolder-backendEPSS 1.2%CVE-2021-32661MEDIUMTechDocs object element script injectionEPSS 1.2%

Referencias