VulnerabilityAnalyzed

CVE-2026-106507

Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by techdocs arbitrary file read via mkdocs snippets.

MEDIUM 6.5EPSS 0.39%

Does this matter?

Lower severity and a low EPSS score (0.39%). Track it; it rarely justifies an emergency change on its own.

Description

Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by techdocs arbitrary file read via mkdocs snippets. Unsafe path resolution in TechDocs source tree handling allows an authenticated user who can register documentation sources to include content from outside the intended documentation boundary. Depending on deployment, this may expose files readable by the build process. This issue is fixed in version 1.15.4.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.39% probability · 33th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-59, CWE-61
Affected: linuxfoundation/backstage plugin-techdocs-node · linuxfoundation/backstage
Source: security-advisories@github.com

EPSS trend

EPSS moved from 0.3% on 7 October 2026 to 0.4% on 26 October 2026.

References

https://github.com/backstage/backstage/commit/911ca36f10e654c5517da029129230fc05a4f580Patch
https://github.com/backstage/backstage/releases/tag/v1.54.6Patch, Release Notes
https://github.com/backstage/backstage/security/advisories/GHSA-vmqh-7cj9-mvcjMitigation, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.