## Backstage catalog rules can be bypassed for URL locations using encoded path segments

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs
- CVE: CVE-2026-115923
- 公開日時: 2026-10-28T22:42:36.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-w658-mh9p-ww8f)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-w658-mh9p-ww8f

影響: npm:@backstage/plugin-catalog-backend < 3.9.2 → 3.9.2, npm:@backstage/plugin-catalog-backend >= 4.0.0, < 4.0.2 → 4.0.2
@backstage/plugin-catalog-backend matches URL-type locations against catalog.rules location patterns using the raw URL string submitted by the user, while URL readers resolve that same string in canonical form when fetching the location's content. A URL can therefore be crafted so that it appears to belong to a trusted location scope during rule evaluation, but is fetched from a different scope. Details When a deployment restricts catalog kinds to trusted URL prefixes using catalog.rules locati…