What is the CVSS score of CVE-2026-25152?

CVE-2026-25152 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Node.js are affected by CVE-2026-25152?

Organizations using Backstage should be aware of moderate risk from CVE-2026-25152, a path traversal vulnerability rated CVSS 5.3. This could allow unauthorized file access.. A patch is available.

How to fix or mitigate CVE-2026-25152?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review file handling controls.

Node.js CVE-2026-25152

MEDIUM

Path Traversal (CWE-22)

2026-01-30 security-advisories@github.com

GHSA-w669-jj7h-88m9

Node.js Docker Path Traversal Backstage Red Hat

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Red Hat

5.3 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

CVE Published

Jan 30, 2026 - 22:15 nvd

MEDIUM 5.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on @backstage/plugin-techdocs-node (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.14.0.

DescriptionGitHub Advisory

Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path traversal vulnerability in the TechDocs local generator allows attackers to read arbitrary files from the host filesystem when Backstage is configured with techdocs.generator.runIn: local. When processing documentation from untrusted sources, symlinks within the docs directory are followed by MkDocs during the build process. File contents are embedded into generated HTML and exposed to users who can view the documentation. This vulnerability is fixed in @backstage/plugin-techdocs-node versions 1.13.11 and 1.14.1. Some workarounds are available. Switch to runIn: docker in app-config.yaml and/or restrict write access to TechDocs source repositories to trusted users only.

AnalysisAI

Backstage TechDocs plugin versions prior to 1.13.11 and 1.14.1 contain a path traversal vulnerability that allows authenticated attackers to read arbitrary files from the host filesystem when the local generator is enabled. The vulnerability stems from insufficient symlink validation during the documentation build process, enabling attackers to embed sensitive file contents into generated HTML accessible to documentation viewers. Organizations using techdocs.generator.runIn: local with untrusted documentation sources are at risk until patching to the fixed versions.

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects Backstage. Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path traversal vulnerability in the TechDocs local generator allows attackers to read arbitrary files from the host filesystem when Backstage is configured with techdocs.generator.runIn: local. When processing documentation from untrusted sources, symlinks within the

RemediationAI

Monitor vendor advisories for a patch. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.