Backstage TechDocs CVE-2026-106507

Requires an authenticated principal with permission to register TechDocs documentation sources (PR:L), and an attacker-controlled source tree containing (1) a symbolic link resolving outside the intended source/documentation directory and (2) an MkDocs snippets include (pymdownx.snippets, '--8<--') referencing that link so the out-of-bounds file is pulled into the build. Exploitation is bounded to files readable by the TechDocs build process and is only meaningful 'depending on deployment' - i.e. instances that build docs from untrusted, user-registerable sources. Limiting factors: no anonymous access (authentication required), high attack complexity (crafted symlink plus snippet chain), reliance on the MkDocs snippets extension, and confidentiality limited to the build process's file permissions; versions 1.15.4 and later reject source trees whose symlinks resolve outside the input directory.

This is a genuine but moderate, pre-conditioned issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N = 5.3) is internally consistent and the signals align: it is network-reachable but requires an authenticated user (PR:L) who already holds the ability to register documentation sources, carries high attack complexity (AC:H) because the attacker must stage both a symlink that resolves outside the source tree AND an MkDocs snippets include that pulls it in, and the impact is confined to confidentiality (C:H, I:N, A:N) - arbitrary read of files the TechDocs build process can access. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The 'Information Disclosure' tag matches the confidentiality-only profile. One nuance to verify: the advisory states impact occurs 'depending on deployment,' meaning exploitability hinges on whether the instance actually builds documentation from attacker-registerable sources and whether the MkDocs snippets extension is in use - these deployment conditions, combined with PR:L and AC:H, meaningfully limit practical risk below what the raw score alone might suggest.

An authenticated user permitted to register a TechDocs documentation source commits a crafted source tree containing a symlink (e.g. 'leak_link' -> /etc/passwd) at the input-directory root plus an MkDocs snippets include (--8<-- "leak_link") in a markdown file. When TechDocs generates the docs, unsafe path resolution follows the symlink outside the intended documentation boundary and embeds the external file's contents into the published documentation, disclosing it to the attacker. No public exploit was identified at time of analysis; exploitation is network-reachable but high-complexity and depends on the MkDocs snippets mechanism.