CVE-2026-25152

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25152", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-29T15:39:11.821Z", "datePublished": "2026-01-30T21:51:22.277Z", "dateUpdated": "2026-02-02T16:29:27.963Z"}, "containers": {"cna": {"title": "@backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/backstage/backstage/security/advisories/GHSA-w669-jj7h-88m9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/backstage/backstage/security/advisories/GHSA-w669-jj7h-88m9"}], "affected": [{"vendor": "backstage", "product": "backstage", "versions": [{"version": "< 1.13.11", "status": "affected"}, {"version": "= 1.14.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-30T21:51:22.277Z"}, "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path traversal vulnerability in the TechDocs local generator allows attackers to read arbitrary files from the host filesystem when Backstage is configured with `techdocs.generator.runIn: local`. When processing documentation from untrusted sources, symlinks within the docs directory are followed by MkDocs during the build process. File contents are embedded into generated HTML and exposed to users who can view the documentation. This vulnerability is fixed in` @backstage/plugin-techdocs-node` versions 1.13.11 and 1.14.1. Some workarounds are available. Switch to `runIn: docker` in `app-config.yaml` and/or restrict write access to TechDocs source repositories to trusted users only."}], "source": {"advisory": "GHSA-w669-jj7h-88m9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-02T16:25:13.197716Z", "id": "CVE-2026-25152", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-02T16:29:27.963Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25152", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-02T16:25:13.197716Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-02T16:25:13.990Z"}}], "cna": {"title": "@backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator", "source": {"advisory": "GHSA-w669-jj7h-88m9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "backstage", "product": "backstage", "versions": [{"status": "affected", "version": "< 1.13.11"}, {"status": "affected", "version": "= 1.14.0"}]}], "references": [{"url": "https://github.com/backstage/backstage/security/advisories/GHSA-w669-jj7h-88m9", "name": "https://github.com/backstage/backstage/security/advisories/GHSA-w669-jj7h-88m9", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path traversal vulnerability in the TechDocs local generator allows attackers to read arbitrary files from the host filesystem when Backstage is configured with `techdocs.generator.runIn: local`. When processing documentation from untrusted sources, symlinks within the docs directory are followed by MkDocs during the build process. File contents are embedded into generated HTML and exposed to users who can view the documentation. This vulnerability is fixed in` @backstage/plugin-techdocs-node` versions 1.13.11 and 1.14.1. Some workarounds are available. Switch to `runIn: docker` in `app-config.yaml` and/or restrict write access to TechDocs source repositories to trusted users only."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-30T21:51:22.277Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25152", "state": "PUBLISHED", "dateUpdated": "2026-02-02T16:29:27.963Z", "dateReserved": "2026-01-29T15:39:11.821Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-30T21:51:22.277Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "backstage", "vendor": "backstage", "versions": [{"status": "affected", "version": "< 1.13.11"}, {"status": "affected", "version": "= 1.14.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*", "matchCriteriaId": "086F7DE4-8356-4AE3-9E29-B852A5C4B2DB", "versionEndExcluding": "1.13.11", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*", "matchCriteriaId": "0393AC7C-1889-4869-ABAF-1C5D96CA2C06", "versionEndExcluding": "1.14.1", "versionStartIncluding": "1.14.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path traversal vulnerability in the TechDocs local generator allows attackers to read arbitrary files from the host filesystem when Backstage is configured with `techdocs.generator.runIn: local`. When processing documentation from untrusted sources, symlinks within the docs directory are followed by MkDocs during the build process. File contents are embedded into generated HTML and exposed to users who can view the documentation. This vulnerability is fixed in` @backstage/plugin-techdocs-node` versions 1.13.11 and 1.14.1. Some workarounds are available. Switch to `runIn: docker` in `app-config.yaml` and/or restrict write access to TechDocs source repositories to trusted users only."}, {"lang": "es", "value": "Backstage es un framework abierto para construir portales de desarrolladores, y @backstage/plugin-techdocs-node proporciona funcionalidades comunes de node.js para TechDocs. En versiones de @backstage/plugin-techdocs-node anteriores a la 1.13.11 y 1.14.1, una vulnerabilidad de salto de ruta en el generador local de TechDocs permite a los atacantes leer archivos arbitrarios del sistema de archivos del host cuando Backstage est\u00e1 configurado con 'techdocs.generator.runIn: local'. Al procesar documentaci\u00f3n de fuentes no confiables, los enlaces simb\u00f3licos dentro del directorio docs son seguidos por MkDocs durante el proceso de construcci\u00f3n. El contenido de los archivos se incrusta en el HTML generado y se expone a los usuarios que pueden ver la documentaci\u00f3n. Esta vulnerabilidad est\u00e1 corregida en las versiones 1.13.11 y 1.14.1 de '@backstage/plugin-techdocs-node'. Algunas soluciones alternativas est\u00e1n disponibles. Cambie a 'runIn: docker' en 'app-config.yaml' y/o restrinja el acceso de escritura a los repositorios de origen de TechDocs solo a usuarios de confianza."}], "id": "CVE-2026-25152", "lastModified": "2026-06-17T10:24:11.980", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25152", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-02T16:25:13.197716Z", "version": "2.0.3"}}]}, "published": "2026-01-30T22:15:56.190", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/backstage/backstage/security/advisories/GHSA-w669-jj7h-88m9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "@backstage/plugin-techdocs-node: @backstage/plugin-techdocs-node Path Traversal in TechDocs Local Generator", "id": "2435575", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2435575"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-22", "details": ["No description is available for this CVE."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-25152", "package_state": [{"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Fix deferred", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform/automation-portal", "product_name": "Self-service automation portal 2"}], "public_date": "2026-01-30T21:51:22Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-25152\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-25152\nhttps://github.com/backstage/backstage/security/advisories/GHSA-w669-jj7h-88m9"], "threat_severity": "Moderate"}

{"analysis": {"en": {"generated_at": "2026-04-18T01:01:48.681397+00:00", "value": {"mitigation_remediation": ["Upgrade '@backstage/plugin-techdocs-node' to version 1.13.11 or later, or to 1.14.1 or later if using that series", "If an upgrade cannot be performed immediately, change the configuration to \"techdocs.generator.runIn: docker\" in app-config.yaml to enforce containerized generation", "Restrict write access to TechDocs source repositories so that only trusted users can contribute documentation, preventing malicious symlinks from being introduced"], "summary": {"action": "Patch", "impact": "Read arbitrary host files via local TechDocs generation"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Backstage framework, specifically the @backstage/plugin-techdocs-node component. Versions prior to 1.13.11 and 1.14.1 are vulnerable; the fix is included in those and later releases.", "description_and_impact": "A path traversal flaw in @backstage/plugin-techdocs-node allows an attacker who can supply documentation containing symbolic links to read any files on the host filesystem when the local generator is enabled. The extracted file contents are embedded into the generated HTML, making them accessible to any user who views the documentation, thereby exposing potentially confidential data. The vulnerability stems from missing sanitization of symlink paths and is classified as CWE-22.", "risk_and_exploitability": "The CVSSv3 score is 5.3, indicating a moderate impact. The EPSS score is less than 1\u202f%, suggesting low current exploitation probability. The flaw is not listed in CISA\u2019s KEV catalog. Exploitation requires Backstage to be configured with \"techdocs.generator.runIn: local\" and an attacker to be able to supply the documentation to be built, typically through access to the source repository. Once the generator processes untrusted docs, it follows symlinks and reads the target files, which are then returned in the generated site."}}}}, "created": "2026-02-02T09:26:47.479604+00:00", "updated": "2026-04-18T01:15:05.976710+00:00", "vendors": ["backstage", "backstage$PRODUCT$backstage"]}