Backstage TechDocs EUVD-2026-94009

Exploitation requires ALL of: (1) an authenticated Backstage user account (PR:L); (2) the TechDocs backend configured to use the Azure Blob Storage publisher provider specifically - other publisher backends are not indicated as affected; and (3) entity-level permissions enabled, which is the boundary being bypassed. The limiting factors that reduce realistic risk are the authentication requirement and the Azure-Blob-Storage-only scope. The aggravating factor explicitly noted by the vendor: deployments that intentionally disable the default backend authentication policy 'may have broader exposure.' Affected versions are prior to @backstage/plugin-techdocs-backend 2.2.4.

This is a moderate-severity, authenticated information-disclosure (path traversal / CWE-22) issue, not an unauthenticated critical. The provided CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5) is internally consistent with the description: network-reachable, low complexity, but requires an authenticated Backstage user (PR:L) and yields confidentiality impact only (read restricted TechDocs), with no integrity or availability impact. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no signal of active or probable exploitation; exploitation status is 'no public exploit identified at time of analysis.' SSVC-style reasoning puts this as a low-urgency item: exploitation=none observed, automatable=no (requires valid authentication and a specific storage backend), technical impact=partial (confidentiality only). The real-world risk is further narrowed by two necessary conditions stated in the description - use of the Azure Blob Storage publisher AND entity-level permissions - meaning only a subset of Backstage deployments are affected. The notable aggravating factor is that deployments which intentionally disable the default backend authentication policy 'may have broader exposure,' per the vendor. Net: a legitimately-filed but not high-priority issue for most environments; prioritize patching only where Azure Blob Storage + entity permissions are in use, or where the default backend auth policy is disabled.

An attacker who already holds a valid (even low-privilege) Backstage account crafts a TechDocs static-content request containing path-traversal sequences (e.g. '../' or encoded Windows separators) to step outside the entity they are authorized to view and read restricted documentation served from Azure Blob Storage. No public exploit code was provided in the input; the fix commit and its added regression tests ('../private/index.html', encoded Windows separators) illustrate the traversal technique. Because the attack is network-based and low-complexity but requires authentication, it is realistic for any insider or compromised user account.