EUVD-2026-94482
GHSA-f7v3-xhm6-w245
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Network-reachable build triggered by an authenticated source-editor (PR:L), low complexity; the build escapes its documentation boundary to read backend/internal data (S:C, C:H), with no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can register or modify documentation sources may cause a TechDocs build to access resources outside the intended documentation boundary, potentially exposing backend-host data or internal network resources. This issue is fixed in versions 1.14.6 and 1.15.4 when pymdown-extensions 10.21.3 or later is also used, normally through mkdocs-techdocs-core 1.7.0 or later.
AnalysisAI
Improper validation of MkDocs Markdown extension configuration in Backstage's TechDocs Node package (@backstage/plugin-techdocs-node) lets an authenticated user who can register or modify documentation sources make a TechDocs build read files or fetch URLs outside the documentation boundary, potentially exposing backend-host data or internal network resources (path traversal, CWE-22). Affected versions are those before 1.14.6 on the 1.14 line and before 1.15.4 on the 1.15 line; the impact is changed-scope with high confidentiality loss and no integrity or availability impact, and it applies to deployments where the Backstage backend generates TechDocs from those sources rather than relying on externally sandboxed CI. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated principal with the ability to register or modify TechDocs documentation sources (PR:L), and a deployment where the Backstage backend itself generates TechDocs (local/in-cluster generation) from those sources rather than from externally sandboxed CI. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a credible, patch-worthy issue but not an emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade @backstage/plugin-techdocs-node to 1.15.4 (or 1.14.6 if pinned to the 1.14 line), which is the vendor-released patch documented in GHSA-f7v3-xhm6-w245 and implemented by commits 017ace52d9b327ededc6704cf17799c875ae0f29 and 2d9de4ca117a529de4b6ed7dfb7aa507ca7b3f91; adopters should track the fixed Backstage release tags v1.50.5 and v1.54.6 for the full framework. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Backstage deployments for @backstage/plugin-techdocs-node and identify any on 1.14.x below 1.14.6 or 1.15.x below 1.15.4; immediately restrict TechDocs documentation-source registration/modification to trusted administrators and disable user-controlled MkDocs extensions or configurations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Backstage is an open platform for building developer portals. Rated critical severity (CVSS 9.9), this vulnerability is
Authenticated Backstage users can retrieve the internal execution data of other users' Scaffolder tasks - notably the Se
Authenticated users who can register or modify a TechDocs documentation source can achieve code execution inside the Bac
Arbitrary Python code execution in Backstage's @backstage/plugin-techdocs-node (versions < 1.13.11 and = 1.14.0) lets a
Authenticated remote code execution in the @backstage/plugin-techdocs-node package shipped with the Backstage developer
Improper task-state validation in the @backstage/plugin-scaffolder-backend plugin (Backstage versions prior to 3.3.1, 3.
Path traversal in the Backstage Scaffolder Bitbucket pull-request publish actions allows an authenticated user who can e
Improper input validation in the @backstage/plugin-scaffolder-backend-module-sentry scaffolder actions (Backstage 0.3.0
@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Rated high severity (C
Improper authentication in the Backstage @backstage/plugin-auth-backend-module-oidc-provider package prior to 0.4.20 let
Server-side request forgery in the Backstage @backstage/plugin-techdocs-node package (0.11.12 through 1.14.6, and 1.15.0
Improper URL validation in the @backstage/plugin-catalog-backend package of Backstage prior to 3.5.1, 3.6.2, 3.7.2, 3.8.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today