Backstage TechDocs CVE-2026-106508

Requires ALL of the following: (1) the TechDocs backend configured with techdocs.publisher.type: 'local' - cloud publishers (S3, GCS, Azure Blob Storage) are explicitly NOT affected; (2) a published documentation directory that contains a symbolic link pointing outside the intended output tree (e.g. to /etc/passwd), which the vendor states does not arise through normal MkDocs operation; and (3) an authenticated user (PR:L) able to reach the documentation serving endpoint. Limiting factors: the non-default local publisher, the need for a pre-existing malicious/misconfigured symlink in the docs source, authenticated access, and confidentiality-only impact (no integrity or availability effect). These combine to the vendor's own 'preconditions that do not arise through normal operation,' consistent with AC:H.

This is a high-CVSS-component but genuinely low-real-world-risk issue, and the signals are largely consistent. The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N = 5.3 Medium) shows a network-reachable serving endpoint but with HIGH attack complexity and LOW-privilege authentication required, and only a confidentiality impact. The vendor (GitHub Security Advisory GHSA-cm77-ch27-6w6v) explicitly states exploitation 'requires preconditions that do not arise through normal MkDocs operation,' which directly supports the AC:H rating and sharply reduces practical exploitability. No EPSS score, no CISA KEV listing, and no public exploit code were provided - the only code evidence is the vendor's own remediation commit, not a proof-of-concept. Exploitation status is therefore: no public exploit identified at time of analysis. The C:H impact (arbitrary host file exposure such as /etc/passwd, per the test fixtures) is the one signal that justifies attention, but it is strongly gated: only the local publisher (techdocs.publisher.type: 'local', a non-recommended production mode) is affected, cloud publishers (S3, GCS, Azure Blob) are explicitly not affected, and a malicious symlink must already exist in the documentation tree. Net: patch during normal maintenance rather than emergency response. One inconsistency to flag: the 'Microsoft' tag in the input is incorrect - Backstage is an independent CNCF/Spotify open-source project, not a Microsoft product.

An authenticated Backstage user browses TechDocs on an instance configured with the local publisher, where a published documentation bundle contains a symlink (e.g. 'leaked' -> /etc/passwd) that was committed or planted in the source docs. When the serving endpoint follows that filesystem reference, the attacker reads host files outside the intended documentation tree. No public proof-of-concept exists - only the vendor patch is available - and the high attack complexity (symlinks do not arise from normal MkDocs builds) makes opportunistic exploitation unlikely.