GHSA-w669-jj7h-88m9
Medium · 5.3CVSS
5.3
EPSS
—
Published
Feb 2, 2026
CISA due date
—
The record
@backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @backstage/plugin-techdocs-node | 0 | 1.13.11 |
| npm | @backstage/plugin-techdocs-node | 1.14.0 | 1.14.1 |
Related vulnerabilities
- CVE-2026-25152 Backstage is an open framework for building developer portals, and… Same vulnerability
- CVE-2026-29186 Backstage is an open framework for building developer portals. Also affects @backstage/plugin-techdocs-node
- GHSA-928r-fm4v-mvrw TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution Also affects @backstage/plugin-techdocs-node
- GHSA-6jr7-99pf-8vgf @backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks Also affects @backstage/plugin-techdocs-node
- CVE-2026-25153 Backstage is an open framework for building developer portals, and… Also affects @backstage/plugin-techdocs-node
- CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22
- CVE-2026-112049 Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in… CWE-22
- CVE-2026-112005 WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote… CWE-22