Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path traversal vulnerability in the TechDocs local generator allows attackers to read arbitrary files from the host filesystem when Backstage is configured with `techdocs.generator.runIn: local`. When processing documentation from untrusted sources, symlinks within the docs directory are followed by MkDocs during the build process. File contents are embedded into generated HTML and exposed to users who can view the documentation. This vulnerability is fixed in` @backstage/plugin-techdocs-node` versions 1.13.11 and 1.14.1. Some workarounds are available. Switch to `runIn: docker` in `app-config.yaml` and/or restrict write access to TechDocs source repositories to trusted users only.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-25152 Path Traversal in Backstage TechDocs Local Generator via Symlink Handling https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25152
Post summary
The post simply lists the CVE number, a brief description of a path‑traversal vulnerability, and a link to a detail page, without providing evidence of exploitation, a PoC, or remediation.
CVE-2026-25152 Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions o… https://www.cve.org/CVERecord?id=CVE-2026-25152
Post summary
The text merely references a CVE record for Backstage's @backstage/plugin-techdocs-node, providing no additional details on exploitation, patch, or technical specifics.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | linuxfoundation | backstage | - | - | - |