A vulnerability in @backstage/plugin-catalog-backend allows bypassing catalog location rules by using encoded path segments in URLs. This causes the system to accept entities from untrusted sources as if they were from trusted locations, potentially leading to unauthorized ingestion of entity content. The issue is fixed in versions 3.9.2 and 4.0.2. No complete workaround exists other than restricting location registration permissions.