CVE-2026-25152: Backstage TechDocs Path Traversal Flaw

CVE-2026-25152 Overview

CVE-2026-25152 is a path traversal vulnerability affecting the @backstage/plugin-techdocs-node package, which provides common Node.js functionalities for TechDocs in the Backstage developer portal framework. This vulnerability allows attackers to read arbitrary files from the host filesystem when Backstage is configured with the local generator option (techdocs.generator.runIn: local).

When processing documentation from untrusted sources, symlinks within the docs directory are followed by MkDocs during the build process. The file contents are then embedded into generated HTML and exposed to users who can view the documentation, resulting in potential exposure of sensitive configuration files, credentials, and other confidential data.

Critical Impact
Attackers can leverage symlink following during documentation builds to extract sensitive files from the host system, potentially exposing credentials, configuration files, and proprietary source code to unauthorized users.

Affected Products

@backstage/plugin-techdocs-node versions prior to 1.13.11
@backstage/plugin-techdocs-node versions prior to 1.14.1
Backstage installations configured with techdocs.generator.runIn: local

Discovery Timeline

2026-01-30 - CVE CVE-2026-25152 published to NVD
2026-02-04 - Last updated in NVD database

Technical Details for CVE-2026-25152

Vulnerability Analysis

This path traversal vulnerability (CWE-22) exploits the symlink following behavior of MkDocs during the TechDocs documentation build process. When Backstage is configured to run the TechDocs generator locally (as opposed to within a Docker container), the build process does not properly validate or restrict symlink targets within documentation source directories.

An attacker with write access to a TechDocs source repository can create symbolic links pointing to sensitive files outside the intended documentation directory. When MkDocs processes these symlinks during the build, it reads the target files and embeds their contents into the generated HTML documentation. Any user with access to view the resulting documentation can then access the exposed file contents.

The vulnerability requires the attacker to have write access to documentation source repositories and for the target Backstage instance to be using the local generator configuration. While this combination of requirements limits the attack surface, environments that allow documentation contributions from untrusted sources are at significant risk.

Root Cause

The root cause is insufficient validation of file paths during the TechDocs build process when running in local mode. The MkDocs documentation generator follows symbolic links without restriction, and the TechDocs plugin does not implement safeguards to prevent symlinks from targeting files outside the documentation directory tree. This allows attackers to bypass intended directory boundaries and access arbitrary files readable by the Backstage process.

Attack Vector

The attack vector is network-based, requiring an attacker to have the ability to commit or modify files in a TechDocs source repository. The attack flow involves:

Attacker creates a symbolic link within the docs directory pointing to a sensitive file (e.g., /etc/passwd, application configuration files, or secrets)
The symlink is committed to a repository configured as a TechDocs source
When TechDocs builds the documentation using the local generator, MkDocs follows the symlink
The contents of the target file are embedded in the generated HTML
Any user viewing the documentation can access the leaked file contents

The exploitation does not require user interaction beyond viewing the documentation, though initial access to modify documentation sources is required. Due to the prerequisite of repository write access and specific configuration requirements, exploitation complexity is elevated.

Detection Methods for CVE-2026-25152

Indicators of Compromise

Presence of symbolic links in TechDocs source repositories pointing outside the docs directory
Documentation build logs showing access to sensitive system files or paths outside the repository
Generated documentation containing embedded content from system files such as /etc/passwd, configuration files, or credential stores
Unexpected file access patterns in Backstage server logs during documentation builds

Detection Strategies

Implement pre-build scanning of documentation repositories to detect symbolic links pointing outside the repository root
Monitor file system access patterns during TechDocs builds for access to sensitive directories
Review Backstage audit logs for documentation builds that access unexpected file paths
Deploy file integrity monitoring on sensitive configuration files that may be targeted

Monitoring Recommendations

Enable verbose logging for the TechDocs build process to capture file access patterns
Configure alerts for documentation builds accessing paths outside the expected repository structure
Implement repository scanning in CI/CD pipelines to detect suspicious symlinks before they reach production
Monitor for unusual documentation viewing patterns that may indicate reconnaissance or data exfiltration

How to Mitigate CVE-2026-25152

Immediate Actions Required

Upgrade @backstage/plugin-techdocs-node to version 1.13.11 or 1.14.1 immediately
Switch TechDocs configuration from runIn: local to runIn: docker to isolate the build environment
Audit existing TechDocs source repositories for suspicious symbolic links
Restrict write access to TechDocs source repositories to trusted users only

Patch Information

The vulnerability is fixed in @backstage/plugin-techdocs-node versions 1.13.11 and 1.14.1. Organizations should update to one of these versions based on their current release track. For additional details, refer to the GitHub Security Advisory.

Workarounds

Switch to runIn: docker in app-config.yaml to run TechDocs builds in an isolated Docker container, preventing access to the host filesystem
Restrict write access to TechDocs source repositories to trusted users only, reducing the attack surface
Implement repository-level hooks to scan for and reject symlinks in documentation directories
Consider running Backstage with reduced filesystem permissions to limit the impact of potential exploitation

yaml

# Recommended app-config.yaml configuration to mitigate the vulnerability
techdocs:
  generator:
    runIn: docker  # Changed from 'local' to isolate builds
  builder: 'local'
  publisher:
    type: 'local'