CVE-2026-106507
MEDIUM 5.3Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by techdocs arbitrary file read via mkdocs snippets. Unsafe path resolution in TechDocs source tree handling allows an authenticated user who can register documentation sources to include content from outside the intended documentation boundary. Depending on deployment, this may expose files readable by the build process. This issue is fixed in version 1.15.4.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.4%chance of exploitation in 30 days · 33rd percentile
Impact if exploited
5.3CVSS 3.1 · MEDIUM
- ConfidentialityHigh
- IntegrityNone
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ⚠Complexity: Needs a race window or specific setup
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Affected
Vendors Backstage @Backstage/Plugin Techdocs Node Linuxfoundation
Products Backstage Plugin Techdocs Node Backstage Plugin Techdocs Node
Weakness (CWE)
- CWE-59: : Improper Link Resolution Before File Access ('Link Following')
- CWE-61: : UNIX Symbolic Link (Symlink) Following
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
References and research data (JSON)
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Linuxfoundation | Backstage Plugin Techdocs Node | < 1.15.4 |
| Linuxfoundation | Backstage | < 1.54.6 |
All CVSS metrics
- MEDIUM 5.3 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N - MEDIUM 5.3 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N - MEDIUM 6.5 v3.1 · NVD Primary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
Patches & mitigations
- https://github.com/backstage/backstage/security/advisories/GHSA-vmqh-7cj9-mvcj CVE record · GitHub_M · Updated 2026-10-06T21:46:08.014Z
NVD · CVE-2026-106507 · Updated 2026-10-09T17:49:24.090 - https://github.com/backstage/backstage/commit/911ca36f10e654c5517da029129230fc05a4f580 CVE record · GitHub_M · Updated 2026-10-06T21:46:08.014Z
NVD · CVE-2026-106507 · Updated 2026-10-09T17:49:24.090 - https://github.com/backstage/backstage/releases/tag/v1.54.6 CVE record · GitHub_M · Updated 2026-10-06T21:46:08.014Z
NVD · CVE-2026-106507 · Updated 2026-10-09T17:49:24.090
Advisories
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-94072 EUVD · EUVD-2026-94072