Threats tagged 'ghsa-pcmq-25r3-5w9v'

A vulnerability in the @backstage/plugin-catalog-backend prior to version 3.9.1 allows inconsistent enforcement of allowed location types during catalog processing. This can lead to the processing of unintended location types, potentially resulting in unintended file access on the backend host. The issue has a low severity rating and a CVSS score of 3.1. A patch is available in version 3.9.1, and no practical workarounds exist.