Is CVE-2026-25152 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25152 being exploited in the wild.

How severe is CVE-2026-25152?

Low severity, with a CVSS score of 3.1, published 2 February 2026.

Which products and versions are affected?

@backstage/plugin-techdocs-node (npm) SEMVER:introduced=1.14.0,fixed=1.14.1.

Is there a fix for CVE-2026-25152?

Yes. @backstage/plugin-techdocs-node (npm): upgrade to 1.14.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-25152 attacked?

It is attacked over the network.

Am I affected by CVE-2026-25152?

Check whether you run @backstage/plugin-techdocs-node (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25152: Backstage TechDocs Node path traversal in local generator

CVE-2026-25152 · Severity: low · CVSS 3.1 · Published 2026-02-02

Backstage's TechDocs documentation builder can follow symbolic links when generating documentation locally, allowing attackers to read arbitrary files from the server and embed them into generated HTML pages. This affects only systems configured to generate documentation locally rather than in Docker containers. Users who can write to documentation repositories can exploit this to access sensitive files.

Technologies: @backstage/plugin-techdocs-node (npm). Vendors: npm.

Quick answers

Is CVE-2026-25152 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25152 being exploited in the wild.
How severe is CVE-2026-25152?: Low severity, with a CVSS score of 3.1, published 2 February 2026.
Which products and versions are affected?: @backstage/plugin-techdocs-node (npm) SEMVER:introduced=1.14.0,fixed=1.14.1.
Is there a fix for CVE-2026-25152?: Yes. @backstage/plugin-techdocs-node (npm): upgrade to 1.14.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25152 attacked?: It is attacked over the network.
Am I affected by CVE-2026-25152?: Check whether you run @backstage/plugin-techdocs-node (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@backstage/plugin-techdocs-node (npm): upgrade to 1.14.1 or later
```
npm install @backstage/plugin-techdocs-node@1.14.1
```

Technical details

A path traversal vulnerability (CWE-22) exists in the TechDocs local generator component when the system is configured with `techdocs.generator.runIn: local`. The vulnerability occurs because MkDocs follows symlinks in the docs directory during the build process without validation. An attacker with write access to a documentation repository can place malicious symlinks pointing to arbitrary files on the host filesystem. During documentation generation, these symlinks are resolved and file contents are embedded into the generated HTML, exposing sensitive data to any user viewing the documentation. The vulnerability requires a Backstage user with repository write permissions, network access to Backstage, and the local generator configuration. Patches are available in versions 1.13.11 and 1.14.1.

Affected products

Backstage @backstage/plugin-techdocs-node versions 1.14.0 < 1.13.10, and all previous versions before 1.13.11

Identifiers

CVE-2026-25152
GHSA-w669-jj7h-88m9

Timeline

2026-01-30: disclosed: Published on NVD
2026-02-02: disclosed: GHSA advisory published
2026-02-02: patched: Patches released in versions 1.13.11 and 1.14.1

References

https://github.com/backstage/backstage/security/advisories/GHSA-w669-jj7h-88m9

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.