Vulnerabilities

TI-2026-69165 CVE-2026-106558 · GHSA-qmw3-745m-w99g

Backstage TechDocs config flaw allows code execution

MEDIUM 40

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00469 Published 2026-10-07 Partial fix · 1.50.7, 1.54.9 +5 CWE-502

TI-2026-69164 CVE-2026-106556

Configuration bypass in Backstage TechDocs mkdocs.yml sanitization

LOW 33

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00257 Published 2026-10-07 Partial fix · 1.50.5, 1.54.6 +2 CWE-184

TI-2026-69157 CVE-2026-106510 · GHSA-4488-j8vj-vqqv

Remote code execution in Backstage TechDocs via crafted mkdocs.yml

LOW 34

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00479 Published 2026-10-07 Partial fix · 1.50.5, 1.54.6 +2 CWE-183

TI-2026-69083 CVE-2026-106509 · GHSA-8w7q-29mw-gf5c

Code injection via MkDocs theme configuration in Backstage TechDocs

LOW 39

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00516 Published 2026-10-06 Partial fix · 1.50.5, 1.54.6 +2 CWE-1336

TI-2026-69082 CVE-2026-106508 · GHSA-cm77-ch27-6w6v

File exposure through local TechDocs publisher in Backstage

LOW 29

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00389 Published 2026-10-06 Fixed in 1.54.6, 1.15.4 CWE-22

TI-2026-69081 CVE-2026-106507

Arbitrary file read in Backstage TechDocs via mkdocs snippets

LOW 29

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00389 Published 2026-10-06 Fixed in 1.54.6, 1.15.4 CWE-59

TI-2026-69079 CVE-2026-106505 · GHSA-p75x-jh7p-ppcx

Bypass of MkDocs config sanitizer in Backstage TechDocs backend

LOW 37

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00312 Published 2026-10-06 Partial fix · 1.50.5, 1.54.6 +2 CWE-426

TI-2026-69051 CVE-2026-106455 · GHSA-q38j-6vcm-2f5m

Server-side request forgery in Backstage TechDocs MkDocs plugin

LOW 34

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.0042 Published 2026-10-06 Partial fix · 1.50.6, 1.54.8 +2 CWE-918

TI-2026-60083 CVE-2026-88064

Backstage: Improper input validation in TechDocs MkDocs configuration

MEDIUM 42

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0118 Published 2026-09-16 Fixed in 1.14.6, 1.15.4 CWE-1336

TI-2026-23303 CVE-2026-29186 · GHSA-928r-fm4v-mvrw

@backstage/plugin-techdocs-node: TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution

MEDIUM 44

Backstage is an open framework for building developer portals.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0087 Published 2026-03-07 Partial fix · 1.14.3 CWE-434

Vulnerabilities

Filters