@backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.
Summary
Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path traversal vulnerability in the TechDocs local generator allows attackers to read arbitrary files from the host filesystem when Backstage is configured with `techdocs.generator.runIn: local`. When processing documentation from untrusted sources, symlinks within the docs directory are followed by MkDocs during the build process. File contents are embedded into generated HTML and exposed to users who can view the documentation. This vulnerability is fixed in` @backstage/plugin-techdocs-node` versions 1.13.11 and 1.14.1. Some workarounds are available. Switch to `runIn: docker` in `app-config.yaml` and/or restrict write access to TechDocs source repositories to trusted users only.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| backstage | backstage | before 1.13.11; = 1.14.0 | 1.13.11 | Patch available | CNA |
| — | @backstage/plugin-techdocs-node (npm) | 1.14.0 to before 1.14.1 | 1.14.1 | Patch available | GHSA-w669-jj7h-88m9 |
| — | @backstage/plugin-techdocs-node (npm) | before 1.13.11 | 1.13.11 | Patch available | GHSA-w669-jj7h-88m9 |
- backstage Vendorbackstage Affected before 1.13.11; = 1.14.0 Fixed in 1.13.11 Patch available CNA
- @backstage/plugin-techdocs-node (npm) Vendor— Affected 1.14.0 to before 1.14.1 Fixed in 1.14.1 Patch available GHSA-w669-jj7h-88m9
- @backstage/plugin-techdocs-node (npm) Vendor— Affected before 1.13.11 Fixed in 1.13.11 Patch available GHSA-w669-jj7h-88m9
Remediation
- Fix · CNA backstage (backstage) Fixed in 1.13.11
- Fix · GHSA-w669-jj7h-88m9 @backstage/plugin-techdocs-node (npm) Fixed in 1.14.1 Advisory →
- Fix · GHSA-w669-jj7h-88m9 @backstage/plugin-techdocs-node (npm) Fixed in 1.13.11 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Developer Hub 1 | Affected | No fix yet: Fix deferred |
| Self-service automation portal 2 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-25152
- 2026-10-03 Alias added: GHSA-w669-jj7h-88m9
- 2026-10-27 Affected versions changed · Red Hat
References
More Backstage vulnerabilities
- TI-2023-17988 Insecure sandbox in Backstage Scaffolder plugin CVSS 3.1CRITICAL 9.9
- TI-2026-69075 Sensitive information exposure in Backstage Scaffolder CVSS 3.1CRITICAL 9.6
- TI-2026-69061 Path traversal in Backstage Bitbucket pull-request scaffolder actions CVSS 3.1CRITICAL 9.9
- TI-2026-60083 Backstage: Improper input validation in TechDocs MkDocs configuration CVSS 3.1HIGH 8.8
- TI-2026-69165 Backstage TechDocs config flaw allows code execution CVSS 3.1HIGH 8.8
- TI-2026-69083 Code injection via MkDocs theme configuration in Backstage TechDocs CVSS 3.1HIGH 8.8
Sources
- CVE-2026-25152 · CVE Program
- CVE-2026-25152 · NVD
- FIRST EPSS
- GHSA-w669-jj7h-88m9 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-25152 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences