CVE-2026-25152: @backstage/plugin-techdocs-node Path Traversal Vulnerability in TechDocs Local Generator
Summary
CVE-2026-25152: @backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator. Affects @backstage/plugin-techdocs-node across 2 version ranges.
< 1.13.11
>= 1.14.0, < 1.14.1
Fixed in 1.13.11 or 1.14.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @backstage/plugin-techdocs-node package is a crucial component of the Backstage platform, enabling users to generate and manage technical documentation. It leverages MkDocs for building documentation, allowing for easy integration and deployment of tech docs. However, a vulnerability has been identified that could allow unauthorized access to sensitive files on the host filesystem when configured to run locally.
Vulnerability Detail
A path traversal vulnerability exists in the TechDocs local generator of the @backstage/plugin-techdocs-node package. This issue arises when the documentation is processed from untrusted sources, as symlinks within the docs directory are followed by MkDocs during the build process. This can lead to attackers reading arbitrary files from the host filesystem, potentially exposing sensitive information to users who can access the documentation.
How To Fix
Latest published version: 2.1.0 as of 23 Oct 2026
npm install @backstage/plugin-techdocs-node@2.1.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.13.111.13.11npm install @backstage/plugin-techdocs-node@1.13.11 -
>= 1.14.0, < 1.14.11.14.1npm install @backstage/plugin-techdocs-node@1.14.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users can switch the configuration to run the generator in a Docker container. This can be done by modifying the app-config.yaml file as follows:
techdocs: generator: runIn: docker
Additionally, it is advisable to restrict write access to TechDocs source repositories to trusted users only.
Conclusion
The path traversal vulnerability in the @backstage/plugin-techdocs-node package poses a significant risk when running the TechDocs local generator. Users are strongly advised to upgrade to the patched versions or implement the suggested workarounds to mitigate potential threats.
See every vulnerability recorded for @backstage/plugin-techdocs-node →
FAQ
A path traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory, potentially leading to unauthorized data exposure.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By utilizing the Vulert playground, you can check if your application is affected without any signup.
The risks include unauthorized access to sensitive files on the host filesystem, which could lead to data breaches or exposure of confidential information.
If an immediate upgrade is not possible, implement the recommended workarounds, such as switching to Docker for running the generator and restricting access to trusted users.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for @backstage/plugin-techdocs-node.
