CVE-2026-106507: Backstage: TechDocs arbitrary file read via mkdocs snippets
Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by techdocs arbitrary file read via mkdocs snippets. Unsafe path resolution in TechDocs source tree handling allows an authenticated user who can register documentation sources to include content from outside the intended documentation boundary. Depending on deployment, this may expose files readable by the build process. This issue is fixed in version 1.15.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@backstage/plugin-techdocs-nodeto a version that resolves this vulnerability.Fixed in 1.15.4
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who can register documentation sources can exploit it. The impact depends on which files are readable by the TechDocs build process in the deployment.
Are default deployments affected?
The issue affects deployments using @backstage/plugin-techdocs-node prior to version 1.15.4 where a user can register documentation sources. The provided information does not establish whether that permission is granted by default.
What should be done if upgrading cannot happen immediately?
Restrict the ability to register documentation sources to trusted users, since that permission is required for exploitation. Also limit the files and privileges accessible to the TechDocs build process to reduce potential exposure.
How can we determine whether we are affected?
Check whether @backstage/plugin-techdocs-node is deployed at a version earlier than 1.15.4, and whether authenticated users can register documentation sources. Systems meeting both conditions should be treated as affected.