CVE-2026-106508: Backstage: Potential file exposure through local TechDocs publisher
Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local techdocs publisher. When using the local TechDocs publisher (techdocs.publisher.type: 'local'), it was possible for the documentation serving endpoint to follow filesystem references outside the intended documentation tree, potentially exposing host files to authenticated users. This is mitigated by the fact that exploration requires preconditions that do not arise through normal MkDocs operation. Cloud-based publishers (S3, GCS, Azure Blob Storage) are not affected. This issue is fixed in version 1.15.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@backstage/plugin-techdocs-nodeto a version that resolves this vulnerability.Fixed in 1.15.4
Event History
Frequently Asked Questions
Which deployments are affected?
Only deployments using the local TechDocs publisher with techdocs.publisher.type set to 'local' are affected. Cloud-based TechDocs publishers using S3, GCS, or Azure Blob Storage are not affected.
What does an attacker need to exploit this issue?
An attacker must be an authenticated user and must be able to cause the documentation serving endpoint to follow filesystem references outside the intended documentation tree. The required preconditions do not arise through normal MkDocs operation.
What is the impact if exploitation succeeds?
The issue may expose files from the host filesystem outside the intended documentation tree. The disclosed impact is confidentiality loss; integrity and availability impacts are not indicated.
How should affected deployments be remediated?
Upgrade @backstage/plugin-techdocs-node to version 1.15.4 or later. If upgrading is not immediately possible, using a cloud-based TechDocs publisher avoids the affected local publisher configuration.