Path traversal

Description

A malicious actor could read sensitive files from the environment where TechDocs documentation is built and published by setting a particular path for docs_dir in mkdocs.yml. These files would then be available over the TechDocs backend API.

This vulnerability is mitigated by the fact that an attacker would need access to modify the mkdocs.yml in the documentation source code, and would also need access to the TechDocs backend API.

Recommendation

Update the @backstage/techdocs-common package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.6.3
• Patched version(s): 0.6.3

References

• GHSA-pgf8-28gg-vpr6
• CVE-2021-32662
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Path traversal in Node-RED-Dashboard - CVE-2021-3223
• Path traversal in url-parse - CVE-2021-27515
• MJML vulnerable to path traversal - CVE-2020-12827
• nanotar is vulnerable to path traversal in parseTar() and parseTarGzip() - CVE-2025-69874

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

@backstage/techdocs-common