CVE-2026-106508: Backstage: Potential file exposure through local TechDocs publisher
Impact
When using the local TechDocs publisher (techdocs.publisher.type: 'local'), it was possible for the documentation serving endpoint to follow filesystem references outside the intended documentation tree, potentially exposing host files to authenticated users.
This is mitigated by the fact that exploration requires preconditions that do not arise through normal MkDocs operation. Cloud-based publishers (S3, GCS, Azure Blob Storage) are not affected.
Patches
Patched in @backstage/plugin-techdocs-node version 1.15.4
Workarounds
If you cannot upgrade immediately, consider switching to an external store for published TechDocs content (e.g. awsS3, googleGcs, or azureBlobStorage publishers)
Other sources
Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local techdocs publisher. When using the local TechDocs publisher (techdocs.publisher.type: 'local'), it was possible for the documentation serving endpoint to follow filesystem references outside the intended documentation tree, potentially exposing host files to authenticated users. This is mitigated by the fact that exploration requires preconditions that do not arise through normal MkDocs operation. Cloud-based publishers (S3, GCS, Azure Blob Storage) are not affected. This issue is fixed in version 1.15.4.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@backstage/plugin-techdocs-nodeto a version that resolves this vulnerability.Fixed in 1.15.4 - Upgrade
Upgrade
@backstage/plugin-techdocs-nodeto a version that resolves this vulnerability.Fixed in 1.15.4 - Configuration
Switch from the local TechDocs publisher (techdocs.publisher.type: 'local') to an external publisher such as awsS3, googleGcs, or azureBlobStorage.
Backstage TechDocs publisher techdocs.publisher.type = awsS3, googleGcs, or azureBlobStorage
Event History
Frequently Asked Questions
Which deployments are affected?
Only deployments using the local TechDocs publisher with techdocs.publisher.type set to 'local' are affected. Cloud-based TechDocs publishers using S3, GCS, or Azure Blob Storage are not affected.
What does an attacker need to exploit this issue?
An attacker must be an authenticated user and must be able to cause the documentation serving endpoint to follow filesystem references outside the intended documentation tree. The required preconditions do not arise through normal MkDocs operation.
What is the impact if exploitation succeeds?
The issue may expose files from the host filesystem outside the intended documentation tree. The disclosed impact is confidentiality loss; integrity and availability impacts are not indicated.
How should affected deployments be remediated?
Upgrade @backstage/plugin-techdocs-node to version 1.15.4 or later. If upgrading is not immediately possible, using a cloud-based TechDocs publisher avoids the affected local publisher configuration.