Executive brief
Backstage's TechDocs documentation builder can follow symbolic links when generating documentation locally, allowing attackers to read arbitrary files from the server and embed them into generated HTML pages. This affects only systems configured to generate documentation locally rather than in Docker containers. Users who can write to documentation repositories can exploit this to access sensitive files.
Technical details
A path traversal vulnerability (CWE-22) exists in the TechDocs local generator component when the system is configured with `techdocs.generator.runIn: local`. The vulnerability occurs because MkDocs follows symlinks in the docs directory during the build process without validation. An attacker with write access to a documentation repository can place malicious symlinks pointing to arbitrary files on the host filesystem. During documentation generation, these symlinks are resolved and file contents are embedded into the generated HTML, exposing sensitive data to any user viewing the documentation. The vulnerability requires a Backstage user with repository write permissions, network access to Backstage, and the local generator configuration. Patches are available in versions 1.13.11 and 1.14.1.
Affected products
- Backstage @backstage/plugin-techdocs-node versions 1.14.0 < 1.13.10, and all previous versions before 1.13.11
Timeline
- 2026-01-30: disclosed: Published on NVD
- 2026-02-02: disclosed: GHSA advisory published
- 2026-02-02: patched: Patches released in versions 1.13.11 and 1.14.1