Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115923— Backstage catalog rules can be bypassed for URL locations using encoded path segments

Quick assessment

Affected
backstage backstage
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Backstage 是一个用于构建开发者门户的开源框架。在 3.9.2 之前的版本，以及 4.0.0 至 4.0.2 之间的版本中， 插件中的 会将原始 URL 与 进行比对；然而，URL 读取器在获取该 URL 之前会先对其进行规范化（canonicalize）。拥有 权限的已认证用户可利用百分号编码的路径片段，使不受信任的 URL 匹配到受信任的位置模式，尽管该 URL 规范化后的实际解析结果已超出该受信任范围。这会导致来自不受信任来源的实体内容被错误地视为受信任内容，而后续可能引发的具体后果则取决于部署配置。

CVSS 6.5 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-115923

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Backstage catalog rules can be bypassed for URL locations using encoded path segments
Source: CVE Program / CVE List V5
Vulnerability Description
Backstage is an open framework for building developer portals. Prior to 3.9.2 and from 4.0.0 until 4.0.2, DefaultCatalogRulesEnforcer in @backstage/plugin-catalog-backend compares the raw location.target URL against catalog.rules, while URL readers canonicalize the same URL before fetching it. An authenticated user with catalog.location.create permission can use percent-encoded path segments to make an untrusted URL match a trusted location pattern even though the canonical URL resolves outside that scope. This admits entity content from an untrusted source as trusted, while further downstream consequences depend on deployment configuration. This issue is fixed in versions 3.9.2 and 4.0.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
backstage backstage < 3.9.2 -

II. Public POCs for CVE-2026-115923

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115923

请登录查看更多情报信息。

Other References for CVE-2026-115923 (5)

IV. Related Vulnerabilities

Same product: backstage
Same vendor: backstage
Same weakness: CWE-22