CVE-2026-115923: Path Traversal and Catalog Rule Bypass in Backstage Catalog Backend

Vulnerability ID: CVE-2026-115923

CVSS Score: 6.5

Published: 2026-10-28

CVE-2026-115923 (GHSA-w658-mh9p-ww8f) is a path traversal and access control bypass vulnerability in Spotify's Backstage developer portal framework, specifically within the @backstage/plugin-catalog-backend package. Prior to patched versions, DefaultCatalogRulesEnforcer evaluated user-supplied URL catalog locations against configured catalog.rules patterns using raw, uncanonicalized strings. Because downstream URL readers canonicalize URLs and resolve dot segments before fetching resources, an authenticated attacker with location registration permissions can supply percent-encoded traversal sequences (such as %2e%2e) to bypass location restrictions and register untrusted catalog entities.

TL;DR

A parser discrepancy between Backstage's DefaultCatalogRulesEnforcer and downstream URL readers allows authenticated users with the catalog.location.create…