CVE-2026-25152: @backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator
Impact A path traversal vulnerability in the TechDocs local generator allows attackers to read arbitrary files from the host filesystem when Backstage is configured with techdocs.generator.runIn: local.
When processing documentation from untrusted sources, symlinks within the docs directory are followed by MkDocs during the build process. File contents are embedded into generated HTML and exposed to users who can view the documentation.
Patches This vulnerability is fixed in @backstage/plugin-techdocs-node version X.X.X. Users should upgrade to this version or later.
Workarounds - Switch to runIn: docker in your app-config.yaml: yaml techdocs: generator: runIn: docker - Restrict write access to TechDocs source repositories to trusted users only
References - https://backstage.io/docs/features/techdocs/configuration
Other sources
Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path traversal vulnerability in the TechDocs local generator allows attackers to read arbitrary files from the host filesystem when Backstage is configured with techdocs.generator.runIn: local. When processing documentation from untrusted sources, symlinks within the docs directory are followed by MkDocs during the build process. File contents are embedded into generated HTML and exposed to users who can view the documentation. This vulnerability is fixed in @backstage/plugin-techdocs-node versions 1.13.11 and 1.14.1. Some workarounds are available. Switch to runIn: docker in app-config.yaml and/or restrict write access to TechDocs source repositories to trusted users only.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25152?
CVE-2026-25152 is classified as a moderate severity vulnerability due to its potential for path traversal attacks.
How do I fix CVE-2026-25152?
To mitigate CVE-2026-25152, upgrade @backstage/plugin-techdocs-node to version 1.14.1 or later.
Which versions of @backstage/plugin-techdocs-node are affected by CVE-2026-25152?
CVE-2026-25152 affects versions prior to 1.13.11 and 1.14.1 of @backstage/plugin-techdocs-node.
What type of attack is possible with CVE-2026-25152?
CVE-2026-25152 allows attackers to perform path traversal attacks to read arbitrary files from the host filesystem.
Is CVE-2026-25152 specific to any configuration?
Yes, CVE-2026-25152 occurs when Backstage is configured with techdocs.generator.runIn set to 'local'.