mas-website

OWASP Mobile Application Security Project Website This repository contains the source and configuration for the OWASP Mobile Application Security Project website mas.owasp.org. This website aggregates, organizes, and presents documentation from the main MAS resources using MkDocs and the...

Security-Champions

OWASP Security Champions Guide Using MKDocs to host our content next to the OWASP project page on https://securitychampions.owasp.org/. Inspired by https://github.com/OWASP/API-Security and https://github.com/OWASP/Top10/tree/master/2021. Building a local copy on Windows Install python python3 -m...

MKdocs 1.2.2 - Directory Traversal

The MKdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain sensitive information. Note the vendor has disputed the vulnerability see references because the dev server must be used in an unsafe way namely public to have this...

CVE-2021-40978

CVE-2021-40978 mkdocs built-in dev-server directory traversal exploitation Mkdocs 1.2.2 allows directory traversal through the built-in dev-server which responds on port 8000. There is below some examples of successfully exploited paths: Impact Using this tecnique it is possible to fetch files...

mkdocs

MkDocs Project documentation with Markdown MkDocs is a fast , simple and downright gorgeous static site generator that's geared towards building project documentation. Documentation source files are written in Markdown, and configured with a single YAML configuration file. It is designed to be ea...

CyberClass

CyberClass This repository contains educational resources for Class'Code CyberClass. Files tree 📦CyberClass ------------------------------------ Root directory ┣ 📂docs --------------------------------------- Website sources ┃ ┣ 📂assets ----------------------------------- General assets logo,...

OSIB

OWASP Open Security Information Base OSIB Project Page: https://owasp.org/www-project-open-security-information-base Software Repository: https://github.com/OWASP/OSIB Provided Tools: mkdocsmacroosib.py manually insallable python module osibmacro.py macro to copy that imports the python module...

EUVD-2026-93986

Backstage: Improper validation of MkDocs plugin configuration in TechDocs...

Backstage: Improper validation of MkDocs plugin configuration in TechDocs

Impact An authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Exposure depends on deployment topology, build mode, and target endpoint protections. Modern...

GHSA-Q38J-6VCM-2F5M Backstage: Improper validation of MkDocs plugin configuration in TechDocs

Impact An authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Exposure depends on deployment topology, build mode, and target endpoint protections. Modern...

GHSA-QMW3-745M-W99G Backstage: Improper validation of TechDocs MkDocs configuration

Impact An attacker who can provide configuration to a TechDocs build may execute code in the generator runtime. Impact is greatest when documentation generation runs with backend credentials or host access. Patches Patched in @backstage/plugin-techdocs-node version 1.15.4. Workarounds Use externa...

Backstage: Improper validation of TechDocs MkDocs configuration

Impact An attacker who can provide configuration to a TechDocs build may execute code in the generator runtime. Impact is greatest when documentation generation runs with backend credentials or host access. Patches Patched in @backstage/plugin-techdocs-node version 1.15.4. Workarounds Use externa...

EUVD-2026-94070

Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend...

Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend

Impact Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. Patches Patched...

GHSA-P75X-JH7P-PPCX Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend

Impact Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. Patches Patched...

EUVD-2026-94073

Backstage has potential file exposure through local TechDocs publisher...

CVE-2026-106509

A flaw was found in the Backstage plugin-techdocs-node package. When TechDocs is configured to build documentation locally or within a container, an authenticated user with write access to a registered repository can submit malicious configuration values within the MkDocs theme settings. This fla...

CVE-2026-106505

A flaw was found in the plugin-techdocs-node component of Backstage. This vulnerability allows an attacker with permission to commit changes to a repository utilizing TechDocs to bypass the MkDocs configuration sanitizer. By supplying a crafted configuration file, the attacker can achieve arbitra...

CVE-2026-106455

A flaw was found in the Backstage @backstage/plugin-techdocs-node package. This vulnerability allows information disclosure when an authenticated attacker with control over a TechDocs documentation repository exploits improper validation of MkDocs plugin configurations. During documentation build...

CVE-2026-106507

Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by techdocs arbitrary file read via mkdocs snippets. Unsafe path resolution in TechDocs source tree handling allows an authenticated user who can register...