Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-106508 · GHSA-cm77-ch27-6w6v

Backstage has potential file exposure through local TechDocs publisher

Risk score
50/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.4%
Published
6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local techdocs publisher. When using the local TechDocs publisher (techdocs.publisher.type: 'local'), it was possible for the documentation serving …
Affected
@backstage/plugin-techdocs-node (npm) < 1.15.4
Fix
Upgrade @backstage/plugin-techdocs-node to 1.15.4 or later.
Exploitation
No known exploitation

Story map

Story map: @backstage/plugin-techdocs-nodeTHE FLAWSTHE FIXCVE-2026-106508Backstage has potential fileexposure through localTechDocs publisherCVSS 6.5 · EPSS 0%CVE-2026-106509Backstage: Improper validationof MkDocs theme configurationin TechDocsCVSS 8.8 · EPSS 0%CVE-2026-106558Backstage: Improper validationof TechDocs MkDocsconfigurationCVSS 8.8 · EPSS 0%CVE-2026-106505Backstage: Bypass of MkDocsconfiguration sanitizer inTechDocs backendCVSS 8.5 · EPSS 0%Upgrade…1.15.4 · 1.14.6 · 1.14.8 · 1.15.6 ·2.0.1or later on your release lineWho is exposed@backstage/plugin-techdocs-node (npm) < 1.15.4AMBER · PATCH THIS WEEK@backstage/plugin-techdocs-nodeBackstage is an open frameworkfor building developer portals.Prior to 1.14.6, the@backstage/plugin-techdocs-node package is affected byimproper validation of mkdocstheme configuration in…Where it standsPublic proof of conceptCONNECTS TOSame weaknessPath traversal (CWE-22)399 other warnings in 30 days →Same productEarlier @backstage/plugin-techdocs-node warnings3 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

@backstage/plugin-techdocs-node: Amber, patch this week. Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container, a user with write access to a registere…

The flaws

  • CVE-2026-106508: Backstage has potential file exposure through local TechDocs publisher (CVSS 6.5 · EPSS 0%)
  • CVE-2026-106509: Backstage: Improper validation of MkDocs theme configuration in TechDocs (CVSS 8.8 · EPSS 0%)
  • CVE-2026-106558: Backstage: Improper validation of TechDocs MkDocs configuration (CVSS 8.8 · EPSS 0%)
  • CVE-2026-106505: Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend (CVSS 8.5 · EPSS 0%)

The fix

Upgrade @backstage/plugin-techdocs-node: 1.15.4 · 1.14.6 · 1.14.8 · 1.15.6 · 2.0.1 or later on your release line

Who is exposed: @backstage/plugin-techdocs-node (npm) < 1.15.4

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 6.5 medium
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
@backstage/plugin-techdocs-nodenpm< 1.15.41.15.4

References

Original description

Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local techdocs publisher. When using the local TechDocs publisher (techdocs.publisher.type: 'local'), it was possible for the documentation serving endpoint to follow filesystem references outside the intended documentation tree, potentially exposing host files to authenticated users. This is mitigated by the fact that exploration requires preconditions that do not arise through normal MkDocs operation. Cloud-based publishers (S3, GCS, Azure Blob Storage) are not affected. This issue is fixed in version 1.15.4.

Last activity 6 Oct 2026. Patch Forecast updates every hour.