CVE-2026-106507

Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by techdocs arbitrary file read via mkdocs snippets. Unsafe path resolution in TechDocs source tree handling allows an authenticated user who can register...

CVE-2026-106508

Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local techdocs publisher. When using the local TechDocs publisher techdocs.publisher.type: 'local', it was possible for the...

CVE-2026-106501

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may...

CVE-2026-106504

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder task logs. An authenticated user who can create and read scaffolder tasks may be able to observe sensitive...

CVE-2026-106497

Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent catalog property permission evaluation. In deployments that use affected value-based catalog permission conditions as a confidentiality boundary...

CVE-2026-106498

Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backstage/plugin-catalog-backend package is affected by improper url validation in catalog entity placeholder resolution. An authenticated Backstage user could craft a catalog entity...

CVE-2026-106508

Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local techdocs publisher. When using the local TechDocs publisher techdocs.publisher.type: 'local', it was possible for the...

CVE-2026-106508

The Backstage framework, specifically the @backstage/plugin-techdocs-node package, is vulnerable to potential file exposure in versions prior to 1.15.4 . When utilizing the local TechDocs publisher (techdocs.publisher.type: 'local'), the documentation serving endpoint may follow filesystem refere...

CVE-2026-106508 Backstage: Potential file exposure through local TechDocs publisher

Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local techdocs publisher. When using the local TechDocs publisher techdocs.publisher.type: 'local', it was possible for the...

CVE-2026-106508 Backstage: Potential file exposure through local TechDocs publisher

Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local techdocs publisher. When using the local TechDocs publisher techdocs.publisher.type: 'local', it was possible for the...

CVE-2026-106508 Backstage: Potential file exposure through local TechDocs publisher

Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local techdocs publisher. When using the local TechDocs publisher techdocs.publisher.type: 'local', it was possible for the...

CVE-2026-106507

Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by techdocs arbitrary file read via mkdocs snippets. Unsafe path resolution in TechDocs source tree handling allows an authenticated user who can register...

CVE-2026-106507

The Backstage framework is vulnerable to an arbitrary file read via mkdocs snippets in the @backstage/plugin-techdocs-node package prior to version 1.15.4 . The root cause is unsafe path resolution during TechDocs source tree handling, which allows an authenticated user capable of registering doc...

CVE-2026-106507 Backstage: TechDocs arbitrary file read via mkdocs snippets

Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by techdocs arbitrary file read via mkdocs snippets. Unsafe path resolution in TechDocs source tree handling allows an authenticated user who can register...

EUVD-2026-94072

Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by techdocs arbitrary file read via mkdocs snippets. Unsafe path resolution in TechDocs source tree handling allows an authenticated user who can register...

CVE-2026-106507 Backstage: TechDocs arbitrary file read via mkdocs snippets

Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by techdocs arbitrary file read via mkdocs snippets. Unsafe path resolution in TechDocs source tree handling allows an authenticated user who can register...

CVE-2026-106507 Backstage: TechDocs arbitrary file read via mkdocs snippets

Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by techdocs arbitrary file read via mkdocs snippets. Unsafe path resolution in TechDocs source tree handling allows an authenticated user who can register...

CVE-2026-106504 Backstage: Sensitive information exposure in scaffolder task logs

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder task logs. An authenticated user who can create and read scaffolder tasks may be able to observe sensitive...

CVE-2026-106504 Backstage: Sensitive information exposure in scaffolder task logs

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder task logs. An authenticated user who can create and read scaffolder tasks may be able to observe sensitive...

CVE-2026-106504 Backstage: Sensitive information exposure in scaffolder task logs

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder task logs. An authenticated user who can create and read scaffolder tasks may be able to observe sensitive...