CVE-2026-115923

A flaw was found in the Backstage plugin-catalog-backend component. This vulnerability allows an authenticated remote attacker with catalog location creation permissions to bypass catalog location rules and import untrusted content. By supplying URLs containing percent-encoded path segments, the...