← Vulnerability feed

Vulnerability record · CVE-2026-25152 · published 30 January 2026

CVE-2026-25152: Linuxfoundation backstage path traversal vulnerability

Linuxfoundation · Backstage

Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path traversal vulnerability in the TechDocs local generator allows attackers to read arbitrary files from the host filesystem when Backstage is configured with `techdocs.generator.runIn: local`. When processing documentation from untrusted sources, symlinks within the docs directory are followed by MkDocs during the build process. File contents are embedded into generated HTML and exposed to users who can view the documentation. This vulnerability is fixed in` @backstage/plugin-techdocs-node` versions 1.13.11 and 1.14.1. Some workarounds are available. Switch to `runIn: docker` in `app-config.yaml` and/or restrict write access to TechDocs source repositories to trusted users only.

6.5 CVSS 3.1 Medium EPSS 0.44% · top 64.3% CWE-22 · Path traversal
6.5CVSS 3.1 base score
0.44%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path traversal vulnerability in the TechDocs local generator allows attackers to read arbitrary files from the host filesystem when Backstage is configured with `techdocs.generator.runIn: local`. When processing documentation from untrusted sources, symlinks within the docs directory are followed by MkDocs during the build process. File contents are embedded into generated HTML and exposed to users who can view the documentation. This vulnerability is fixed in` @backstage/plugin-techdocs-node` versions 1.13.11 and 1.14.1. Some workarounds are available. Switch to `runIn: docker` in `app-config.yaml` and/or restrict write access to TechDocs source repositories to trusted users only.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/backstage/backstage/security/advisories/GHSA-w669-jj7h-88m9 Vendor Advisory

Track CVE-2026-25152 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2023-35926Linuxfoundation backstage code injection vulnerabilityBackstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox…EPSS 1.9%8.8CVE-2026-25153Linuxfoundation backstage code injection vulnerabilityBackstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDo…EPSS 0.62%8.5CVE-2021-43783Linuxfoundation backstage path traversal vulnerability@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. In affected versions a malicious actor with write a…EPSS 1.2%6.5CVE-2024-45815Linuxfoundation backstage prototype pollution vulnerabilityBackstage is an open framework for building developer portals. A malicious actor with authenticated access to a Backstage instance with the catalog b…EPSS 0.51%6.5CVE-2024-45816Linuxfoundation backstage relative path traversal vulnerabilityBackstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access co…EPSS 0.73%6.5CVE-2021-32662Linuxfoundation backstage path traversal vulnerabilityBackstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In `@back…EPSS 1.3%5.7CVE-2023-6944Redhat red hat developer hub error message information leak vulnerabilityA flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded …EPSS 0.56%5.4CVE-2024-46976Linuxfoundation backstage cross-site scripting vulnerabilityBackstage is an open framework for building developer portals. An attacker with control of the contents of the TechDocs storage buckets is able to in…EPSS 0.29%

Source: NIST National Vulnerability Database (record CVE-2026-25152), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.