GitHub Advisoryadvisory · npm

GHSA-7mfx-xg57-53c9 Backstage: Improper input validation in TechDocs static content requests

MEDIUM Published 2026-10-07 Modified 2026-10-07 Official page ↗
Aliases
CVE-2026-106490
Ecosystem
npm
Packages
@backstage/plugin-techdocs-backend
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22, CWE-23
Reviewed
2026-10-07

Affected packages

• npm @backstage/plugin-techdocs-backend: < 2.2.4 → fixed in 2.2.4

Description

Impact When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. Patches Patched in `@backstage/plugin-techdocs-backend` version `2.2.4` Workarounds • Restrict access to the TechDocs backend to users who are permitted to view all stored documentation until an upgrade can be applied. • Keep the default backend authentication policy enabled.

Related

Alias · CVE (1)

  • CVE-2026-106490 Backstage is an open framework for building developer portals. vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-23 Relative Path Traversal weakness

References