Skip to content
OpenAdvisories

Package · npm

@backstage/plugin-techdocs-node

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-106508

    Backstage: Potential file exposure through local TechDocs publisher

    Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local techdocs publisher. When using the local TechDocs publisher (techdocs.publisher.ty…

    backstage backstage plugin-techdocs-node @backstage/plugin-techdocs-node npm
  • Medium 5.3
    CVE-2026-25152

    @backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator

    Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path traversal vulnerability…

    backstage backstage @backstage/plugin-techdocs-node npm
  • Medium —
    GHSA-4jqc-jvh2-pxg9

    Path traversal for local publishers in TechDocs backend

    ### Impact A malicious actor with the ability to register entities in the Software Catalog is able to write files to arbitrary paths on the techdocs backend host instance when `techdocs.publisher.type` is set to `local`. This vulnerability is mitigated by the…

    @backstage/plugin-techdocs-node @backstage/techdocs-common npm