CVE-2026-25152: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25152 is a path traversal vulnerability in the @backstage/plugin-techdocs-node npm package, an open-source framework component used to build developer portals. The flaw allows low-privileged attackers to read arbitrary files from the host filesystem when Backstage is configured with techdocs.generator.runIn: local. Affected versions include all releases of @backstage/plugin-techdocs-node prior to 1.13.11 and version 1.14.0 (prior to 1.14.1). The vulnerability was published on January 30, 2026, with fixes released the same day (Github Advisory, Red Hat Bugzilla). It carries a CVSS v3.1 base score of 6.5 (Medium) per NVD, and 5.3 (Moderate) per the GitHub Security Advisory (Github Advisory).

The root cause is improper limitation of a pathname to a restricted directory (CWE-22), specifically through symlink following during the MkDocs documentation build process. When the TechDocs local generator processes documentation, it does not prevent symlinks placed within the docs directory from resolving to arbitrary locations on the host filesystem. An attacker with write access to a TechDocs source repository can plant a symlink pointing to sensitive host files (e.g., /etc/passwd, private keys); MkDocs follows the symlink during the build, embeds the file contents into the generated HTML, and the content becomes visible to any user with documentation viewing access. This attack requires low privileges (repository write access) and no user interaction, but does require the techdocs.generator.runIn: local configuration to be active (Github Advisory, Red Hat Bugzilla).

Successful exploitation results in a high confidentiality impact — arbitrary files readable by the Backstage service process can be exfiltrated and exposed to any user who can view the generated documentation. Sensitive targets include configuration files, credentials, private keys, environment variable files, and other host filesystem data accessible to the process. There is no integrity or availability impact; however, exposure of credentials or secrets could enable lateral movement or privilege escalation beyond the initial Backstage instance (Github Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.025% (8th percentile), indicating a low near-term exploitation probability (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Gain repository write access: Obtain low-privileged write access to a TechDocs source repository connected to a Backstage instance configured with techdocs.generator.runIn: local.
2. Create a malicious symlink: Within the repository's docs directory, create a symlink pointing to a sensitive file on the host filesystem, e.g., ln -s /etc/passwd docs/sensitive.md.
3. Commit and push: Push the symlink to the repository so it is picked up by the TechDocs generator during the next documentation build.
4. Trigger documentation build: Initiate or wait for a TechDocs build — this can happen automatically on push or be triggered manually via the Backstage UI.
5. Access exposed content: Navigate to the generated documentation page corresponding to the symlinked file. The contents of the target host file will be embedded in the rendered HTML and visible to any user with documentation viewing permissions (Github Advisory, Red Hat Bugzilla).

• File System: Presence of symlinks within TechDocs docs directories pointing outside the repository root (e.g., to /etc/, /root/, /home/, or application secret paths).
• File System: Unexpected or sensitive file contents (e.g., /etc/passwd, .env, private key material) embedded in generated TechDocs HTML output files.
• Logs: TechDocs build logs showing MkDocs processing files that resolve outside the expected docs/ directory boundary.
• Logs: Backstage application logs indicating documentation builds triggered from recently modified repositories, especially those with new contributors or unusual commit patterns.
• Network: Unusual access patterns to TechDocs documentation pages by users who would not normally view that content, potentially indicating reconnaissance of exposed file contents.

Upgrade @backstage/plugin-techdocs-node to version 1.13.11 (for the 1.13.x branch) or 1.14.1 (for the 1.14.x branch), which contain the fix (Github Advisory). If immediate upgrade is not possible, two workarounds are available: (1) switch the TechDocs generator configuration from runIn: local to runIn: docker in app-config.yaml — the Docker-based generator does not follow host symlinks in the same way; and (2) restrict write access to all TechDocs source repositories to trusted users only, preventing untrusted parties from injecting malicious symlinks (Red Hat Bugzilla).

The advisory was published by Backstage maintainer benjdlambert via the GitHub Security Advisory program on January 30, 2026. Red Hat tracked the issue via Bugzilla (Bug 2435575) with a medium severity rating. No significant public researcher commentary or broader media coverage has been identified beyond standard vulnerability database aggregation (Github Advisory, Red Hat Bugzilla).