Summary
Backstage: Improper input validation in TechDocs static content requests
Advisory details
Impact
When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure.
Patches
Patched in @backstage/plugin-techdocs-backend version 2.2.4
Workarounds
- Restrict access to the TechDocs backend to users who are permitted to view all stored documentation until an upgrade can be applied.
- Keep the default backend authentication policy enabled.
References
- https://github.com/advisories/GHSA-7mfx-xg57-53c9
- https://github.com/backstage/backstage/security/advisories/GHSA-7mfx-xg57-53c9
- https://nvd.nist.gov/vuln/detail/CVE-2026-106490
- https://github.com/backstage/backstage/commit/40ecc4c2e88b0218125b0a3405d1f6315b321974
- https://github.com/backstage/backstage/releases/tag/v1.54.6
Related vulnerabilities
All Supply chain →- HIGHGHSA-5rmq-chc7-m22f
Vibe-Trading file-read tools expose arbitrary server-readable files
- MEDIUMCVE-2026-59149
@Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)
- MEDIUMCVE-2026-50024
GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server
- HIGHCVE-2026-63490
Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass
- HIGHCVE-2026-59832
Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db
- MEDIUMCVE-2026-104102
copyparty FTP: upload outside defined volumes (limited path traversal)