4vulnerabilities
- Critical0 (0.0%)
- High1 (25.0%)
- Medium0 (0.0%)
- Moderate3 (75.0%)
- Low0 (0.0%)
backstage-plugin-techdocs-backend
Ecosystem: npm
Downloads: 501.96 K
- 0CriticalAffects 0 versions
- 1HighAffects 1 version
- 0MediumAffects 0 versions
- 3ModerateAffects 3 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 2 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 2
- Low: 0
- 2 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (4)
Known vulnerabilities affecting backstage-plugin-techdocs-backend, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-7mfx-xg57-53c9 | Moderate | Backstage: Improper input validation in TechDocs static content requests### Impact When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. ### Patches Patched in `@backstage/plugin-techdocs-backend` version `2.2.4` ### Workarounds - Restrict access to the TechDocs backend to users who are permitted to view all stored documentation until an upgrade can be applied. - Keep the default backend authentication policy enabled. |
| GitHub (opens in a new tab) | |
| GHSA-rg9r-hr7g-5gc2 | Moderate | Backstage: Improper authorization enforcement for TechDocs static content### Impact An authenticated user with access to one TechDocs documentation site could craft a URL able to read documentation belonging to a different entity. This only affects deployments using the external TechDocs builder with an external storage provider (S3, GCS, etc.) and the permission framework enabled. Instances that do not use the permission framework are unaffected, since TechDocs content is visible to all authenticated users by design. ### Patches Patched in `@backstage/plugin-techdocs-backend` version `2.2.4` ### Workarounds - None other than upgrading. Deployments that serve |
| GitHub (opens in a new tab) | |
| GHSA-39v3-f278-vj3g | High | @backstage/plugin-techdocs-backend storage bucket Directory Traversal vulnerability### Impact When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not intended to be accessible, as well as bypass permission checks in Backstage. ### Patches This has been fixed in the 1.10.13 release of the `@backstage/plugin-techdocs-backend` package. ### References If you have any questions or comments about this advisory: Open an issue in the [Backstage repository](https://github.com/backstage/backstage) Visit our Discord, linked to in [Backstage README](https://github.co |
| GitHub (opens in a new tab) | |
| GHSA-5j94-f3mf-8685 | Moderate | @backstage/plugin-techdocs-backend vulnerable to circumvention of cross site scripting protection### Impact An attacker with control of the contents of the TechDocs storage buckets is able to inject executable scripts in the TechDocs content that will be executed in the victim's browser when browsing documentation or navigating to an attacker provided link. ### Patches This has been fixed in the 1.10.13 release of the `@backstage/plugin-techdocs-backend` package. ### References If you have any questions or comments about this advisory: Open an issue in the [Backstage repository](https://github.com/backstage/backstage) Visit our Discord, linked to in [Backstage README](https://github |
| GitHub (opens in a new tab) |
- GHSA-7mfx-xg57-53c9ModerateBackstage: Improper input validation in TechDocs static content requests
< 2.2.4
### Impact When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. ### Patches Patched in `@backstage/plugin-techdocs-backend` version `2.2.4` ### Workarounds - Restrict access to the TechDocs backend to users who are permitted to view all stored documentation until an upgrade can be applied. - Keep the default backend authentication policy enabled.
CVE: CVE-2026-106490
- GHSA-rg9r-hr7g-5gc2ModerateBackstage: Improper authorization enforcement for TechDocs static content
< 2.2.4
### Impact An authenticated user with access to one TechDocs documentation site could craft a URL able to read documentation belonging to a different entity. This only affects deployments using the external TechDocs builder with an external storage provider (S3, GCS, etc.) and the permission framework enabled. Instances that do not use the permission framework are unaffected, since TechDocs content is visible to all authenticated users by design. ### Patches Patched in `@backstage/plugin-techdocs-backend` version `2.2.4` ### Workarounds - None other than upgrading. Deployments that serve
CVE: CVE-2026-106489
- GHSA-39v3-f278-vj3gHigh@backstage/plugin-techdocs-backend storage bucket Directory Traversal vulnerability
< 1.10.13
### Impact When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not intended to be accessible, as well as bypass permission checks in Backstage. ### Patches This has been fixed in the 1.10.13 release of the `@backstage/plugin-techdocs-backend` package. ### References If you have any questions or comments about this advisory: Open an issue in the [Backstage repository](https://github.com/backstage/backstage) Visit our Discord, linked to in [Backstage README](https://github.co
CVE: CVE-2024-45816
- GHSA-5j94-f3mf-8685Moderate@backstage/plugin-techdocs-backend vulnerable to circumvention of cross site scripting protection
< 1.10.13
### Impact An attacker with control of the contents of the TechDocs storage buckets is able to inject executable scripts in the TechDocs content that will be executed in the victim's browser when browsing documentation or navigating to an attacker provided link. ### Patches This has been fixed in the 1.10.13 release of the `@backstage/plugin-techdocs-backend` package. ### References If you have any questions or comments about this advisory: Open an issue in the [Backstage repository](https://github.com/backstage/backstage) Visit our Discord, linked to in [Backstage README](https://github
CVE: CVE-2024-46976