Plugin Techdocs Backend
Monthly
Improper input validation in the @backstage/plugin-techdocs-backend static content router (versions prior to 2.2.4) lets an authenticated Backstage user reach TechDocs static files outside the entity they are authorized to view when the Azure Blob Storage publisher provider is configured and entity-level permissions are enabled, resulting in high-confidentiality information disclosure. The flaw is a path traversal (CWE-22) reachable over the network by a low-privileged account, rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N); Azure-Blob-Storage-only scope and the required authenticated session keep realistic risk moderate. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-released fix is @backstage/plugin-techdocs-backend 2.2.4, published in the Backstage monorepo release v1.54.6.
Authenticated users of Backstage TechDocs can bypass entity-scoped authorization and read documentation belonging to other entities by requesting a crafted /static/docs/... URL containing percent-encoded parent-directory (%2e%2e) segments. The issue is confined to deployments that combine the external TechDocs builder with an external storage provider (S3, GCS, etc.) and have the Backstage permission framework enabled; setups without the permission framework are unaffected because TechDocs content is intentionally readable by all authenticated users, and the default local builder/storage path is not exposed. Exploitation requires an authenticated account that already has access to at least one TechDocs site (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5), exposure is therefore limited to confidentiality of docs across entity boundaries, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Improper input validation in the @backstage/plugin-techdocs-backend static content router (versions prior to 2.2.4) lets an authenticated Backstage user reach TechDocs static files outside the entity they are authorized to view when the Azure Blob Storage publisher provider is configured and entity-level permissions are enabled, resulting in high-confidentiality information disclosure. The flaw is a path traversal (CWE-22) reachable over the network by a low-privileged account, rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N); Azure-Blob-Storage-only scope and the required authenticated session keep realistic risk moderate. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-released fix is @backstage/plugin-techdocs-backend 2.2.4, published in the Backstage monorepo release v1.54.6.
Authenticated users of Backstage TechDocs can bypass entity-scoped authorization and read documentation belonging to other entities by requesting a crafted /static/docs/... URL containing percent-encoded parent-directory (%2e%2e) segments. The issue is confined to deployments that combine the external TechDocs builder with an external storage provider (S3, GCS, etc.) and have the Backstage permission framework enabled; setups without the permission framework are unaffected because TechDocs content is intentionally readable by all authenticated users, and the default local builder/storage path is not exposed. Exploitation requires an authenticated account that already has access to at least one TechDocs site (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5), exposure is therefore limited to confidentiality of docs across entity boundaries, and no public exploit code or confirmed active exploitation was identified at time of analysis.