Backstage TechDocs CVE-2026-106489

Exploitation requires ALL of the following to hold simultaneously: (1) the deployment uses the external TechDocs builder with an external storage provider such as AWS S3 or Google Cloud Storage; (2) the Backstage permission framework is enabled (permission.enabled: true); and (3) the attacker is an authenticated user who already has authorized access to at least one TechDocs documentation site. Given those, the attacker sends a crafted request to the /static/docs/... endpoint using percent-encoded dot-dot (%2e%2e) segments to traverse outside their permitted entity directory. LIMITING FACTORS: authentication is required (PR:L); the permission framework must be explicitly enabled - instances without it are unaffected because TechDocs content is intentionally visible to all authenticated users; and the non-default external-builder + external-storage configuration must be in use. These preconditions substantially narrow the exposed population below what the network attack vector alone would suggest.

Signals converge on a moderate, conditional risk rather than an urgent one. The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) describes a network-reachable, low-complexity information-disclosure flaw that nonetheless requires an authenticated account (PR:L) and yields confidentiality-only impact (I:N/A:N). No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified. The CVE is NOT listed in CISA KEV and no packaged public exploit is referenced, so exploitation status is 'no public exploit identified at time of analysis' - however, the fixing commit (bf6bbf7) ships a regression test embedding the exact working payload '/static/docs/default/component/entity-a/%2e%2e/entity-b/index.html', which effectively discloses the technique to any reader of the patch. The decisive risk-limiting factor is configuration scope: the flaw only manifests when the external TechDocs builder is used with an external storage provider (S3/GCS/etc.) AND the permission framework is enabled; deployments without the permission framework are unaffected by design. No SSVC decision record was supplied. Net: this is a legitimately real but narrowly-scoped authorization-bypass affecting a subset of Backstage installations, not a high-CVSS-but-illusory issue, yet also not a mass-exploitation priority given the authentication requirement, confidentiality-only impact, and restrictive configuration preconditions.

An authenticated engineer who is authorized to view the TechDocs site for one catalog entity crafts a request containing encoded '..' path segments (e.g. %2e%2e) to traverse out of their permitted entity path and retrieve documentation belonging to a different entity whose docs the permission framework was meant to hide from them. Because exploitation is network-based, low-complexity (AV:N/AC:L) and needs only a valid low-privilege session plus the specific external-storage + permission-framework configuration, it is trivial once those preconditions hold. No packaged public exploit is referenced, but the vendor's fixing commit includes a test case that reproduces the exact traversal payload.