@backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260123025240, <=0.0.0-nightly-20260126030220), @techdocs/cli (>=0.0.0-nightly-20260123025240, <=0.0.0-nightly-20260126030220) potentially affected by CVE-2026-25153 via @backstage/plugin-techdocs-node (1.14.0)

@backstage/plugin-techdocs-node NPM version 1.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-techdocs-node and may be impacted: - @backstage/plugin-techdocs-backend =0.0.0-nightly-20260123025240, =0.0.0-nightly-20260123025240,...

@backstage/plugin-search-backend-module-techdocs (0.4.11-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260123025240, <=2.1.5-next.0) +1 more potentially affected by CVE-2026-25153 via @backstage/plugin-techdocs-node (>=1.14.0, <=1.14.1-next.0)

@backstage/plugin-techdocs-node NPM version =1.14.0, =0.0.0-nightly-20260123025240, =0.0.0-nightly-20260123025240, =1.10.5-next.0 Source cves: CVE-2026-25153 Source advisory: OSV:GHSA-6JR7-99PF-8VGF...

@backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator

Impact A path traversal vulnerability in the TechDocs local generator allows attackers to read arbitrary files from the host filesystem when Backstage is configured with techdocs.generator.runIn: local. When processing documentation from untrusted sources, symlinks within the docs directory are...

GHSA-W669-JJ7H-88M9 @backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator

Impact A path traversal vulnerability in the TechDocs local generator allows attackers to read arbitrary files from the host filesystem when Backstage is configured with techdocs.generator.runIn: local. When processing documentation from untrusted sources, symlinks within the docs directory are...

@backstage/plugin-search-backend-module-techdocs (>=0.4.2-next.0, <=0.4.9-next.1), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.4-next.2) +2 more potentially affected by CVE-2026-25152 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.13.11-next.0)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.4.2-next.0, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.10.4-next.2 Source cves: CVE-2026-25152 Source advisory: OSV:GHSA-W669-JJ7H-88M9...

@backstage/plugin-search-backend-module-techdocs (>=0.4.2-next.0, <=0.4.9-next.1), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.4-next.2) +2 more potentially affected by CVE-2026-25152 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.13.11-next.0)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.4.2-next.0, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.10.4-next.2 Source cves: CVE-2026-25152 Source advisory: GHSA-W669-JJ7H-88M9...

@backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260123025240, <=0.0.0-nightly-20260126030220), @techdocs/cli (>=0.0.0-nightly-20260123025240, <=0.0.0-nightly-20260126030220) potentially affected by CVE-2026-25152 via @backstage/plugin-techdocs-node (1.14.0)

@backstage/plugin-techdocs-node NPM version 1.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-techdocs-node and may be impacted: - @backstage/plugin-techdocs-backend =0.0.0-nightly-20260123025240, =0.0.0-nightly-20260123025240,...

@backstage/plugin-search-backend-module-techdocs (0.4.11-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260123025240, <=2.1.5-next.0) +1 more potentially affected by CVE-2026-25152 via @backstage/plugin-techdocs-node (>=1.14.0, <=1.14.1-next.0)

@backstage/plugin-techdocs-node NPM version =1.14.0, =0.0.0-nightly-20260123025240, =0.0.0-nightly-20260123025240, =1.10.5-next.0 Source cves: CVE-2026-25152 Source advisory: OSV:GHSA-W669-JJ7H-88M9...

CVE-2026-25152

Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path traversal vulnerability in the TechDocs local generator allow...

CVE-2026-25153

Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, when TechDocs is configured with runIn: local, a malicious actor who...

CVE-2026-25152 @backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator

Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path traversal vulnerability in the TechDocs local generator allow...

CVE-2026-25152

The CVE-2026-25152 entry concerns the Backstage @backstage/plugin-techdocs-node, where versions before 1.13.11 and 1.14.1 allow path traversal via the TechDocs local generator when techdocs.generator.runIn is set to local. This permits reading arbitrary host files as MkDocs follows symlinks in do...

EUVD-2026-5002

Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path traversal vulnerability in the TechDocs local generator allow...

CVE-2026-25152

Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path traversal vulnerability in the TechDocs local generator allow...

CVE-2026-25152 @backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator

Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path traversal vulnerability in the TechDocs local generator allow...

CVE-2026-25152 @backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator

Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path traversal vulnerability in the TechDocs local generator allow...

Directory Traversal

Overview @backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli Affected versions of this package are vulnerable to Directory Traversal via the TechdocsGenerator function when processing documentation from...

CVE-2026-25152

Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path traversal vulnerability in the TechDocs local generator allow...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20230323021924, <=0.4.9-next.1), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.4-next.2) +2 more potentially affected by CVE-2026-25152 via @backstage/plugin-techdocs-node (>=0.0.0-nightly-20220315022536, <=1.13.11-next.0)

@backstage/plugin-techdocs-node NPM version =0.0.0-nightly-20220315022536, =0.0.0-nightly-20230323021924, =0.0.0-nightly-2021111822616, =0.0.0-nightly-20220305022735, =0.0.0-nightly-2021111822616, =1.10.4-next.2 Source cves: CVE-2026-25152 Source advisory: MEND:CVE-2026-25152...

@backstage/plugin-search-backend-module-techdocs (>=0.4.2-next.0, <=0.4.9-next.1), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.4-next.2) +2 more potentially affected by CVE-2026-25152 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.13.11-next.0)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.4.2-next.0, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.10.4-next.2 Source cves: CVE-2026-25152 Source advisory: SNYK:JS-BACKSTAGEPLUGINTECHDOCSNODE-15166605...