← Vulnerability feed

Vulnerability record · CVE-2021-32662 · published 3 June 2021

CVE-2021-32662: Linuxfoundation backstage path traversal vulnerability

Linuxfoundation · Backstage

Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In `@backstage/techdocs-common` versions prior to 0.6.3, a malicious actor could read sensitive files from the environment where TechDocs documentation is built and published by setting a particular path for `docs_dir` in `mkdocs.yml`. These files would then be available over the TechDocs backend API. This vulnerability is mitigated by the fact that an attacker would need access to modify the `mkdocs.yml` in the documentation source code, and would also need access to the TechDocs backend API. The vulnerability is patched in the `0.6.3` release of `@backstage/techdocs-common`.

6.5 CVSS 3.1 Medium EPSS 1.3% · top 31.1% CWE-22 · Path traversal
6.5CVSS 3.1 base score, v2 3.5
1.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In `@backstage/techdocs-common` versions prior to 0.6.3, a malicious actor could read sensitive files from the environment where TechDocs documentation is built and published by setting a particular path for `docs_dir` in `mkdocs.yml`. These files would then be available over the TechDocs backend API. This vulnerability is mitigated by the fact that an attacker would need access to modify the `mkdocs.yml` in the documentation source code, and would also need access to the TechDocs backend API. The vulnerability is patched in the `0.6.3` release of `@backstage/techdocs-common`.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/backstage/backstage/commit/8cefadca04cbf01d0394b0cb1983247e5f1d6208 PatchThird Party Advisory
https://github.com/backstage/backstage/releases/tag/release-2021-05-27 Release NotesThird Party Advisory
https://github.com/backstage/backstage/security/advisories/GHSA-pgf8-28gg-vpr6 Third Party Advisory
https://github.com/backstage/backstage/commit/8cefadca04cbf01d0394b0cb1983247e5f1d6208 PatchThird Party Advisory
https://github.com/backstage/backstage/releases/tag/release-2021-05-27 Release NotesThird Party Advisory
https://github.com/backstage/backstage/security/advisories/GHSA-pgf8-28gg-vpr6 Third Party Advisory

Track CVE-2021-32662 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2023-35926Linuxfoundation backstage code injection vulnerabilityBackstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox…EPSS 1.9%8.8CVE-2026-25153Linuxfoundation backstage code injection vulnerabilityBackstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDo…EPSS 0.62%8.5CVE-2021-43783Linuxfoundation backstage path traversal vulnerability@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. In affected versions a malicious actor with write a…EPSS 1.2%6.5CVE-2026-25152Linuxfoundation backstage path traversal vulnerabilityBackstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDo…EPSS 0.44%6.5CVE-2024-45815Linuxfoundation backstage prototype pollution vulnerabilityBackstage is an open framework for building developer portals. A malicious actor with authenticated access to a Backstage instance with the catalog b…EPSS 0.51%6.5CVE-2024-45816Linuxfoundation backstage relative path traversal vulnerabilityBackstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access co…EPSS 0.73%5.7CVE-2023-6944Redhat red hat developer hub error message information leak vulnerabilityA flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded …EPSS 0.56%5.4CVE-2024-46976Linuxfoundation backstage cross-site scripting vulnerabilityBackstage is an open framework for building developer portals. An attacker with control of the contents of the TechDocs storage buckets is able to in…EPSS 0.29%

Source: NIST National Vulnerability Database (record CVE-2021-32662), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.