CVE-2026-25152
Path Traversal in Backstage TechDocs Plugin Exposes Files
Publication date: 2026-01-30
Last updated on: 2026-02-19
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linuxfoundation | backstage | to 1.13.11 (exc) |
| linuxfoundation | backstage | From 1.14.0 (inc) to 1.14.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a path traversal issue in the TechDocs local generator of the @backstage/plugin-techdocs-node package. It allows attackers to read arbitrary files from the host filesystem when Backstage is configured with 'techdocs.generator.runIn: local'. This happens because symlinks within the documentation directory are followed during the build process, causing file contents from outside the intended directory to be embedded into generated HTML and exposed to users viewing the documentation.
How can this vulnerability impact me? :
An attacker can exploit this vulnerability to read sensitive files on the host system by embedding their contents into the generated documentation HTML. This can lead to unauthorized disclosure of confidential information to users who have access to view the documentation, potentially exposing sensitive data stored on the host.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update @backstage/plugin-techdocs-node to version 1.13.11 or 1.14.1 or later. Alternatively, switch the TechDocs configuration in app-config.yaml to use 'runIn: docker' instead of 'runIn: local'. Additionally, restrict write access to TechDocs source repositories to trusted users only.