Description
A malicious actor could read sensitive files from the environment where TechDocs documentation is built and published by setting a particular path for docs_dir in mkdocs.yml. These files would then be available over the TechDocs backend API.
This vulnerability is mitigated by the fact that an attacker would need access to modify the mkdocs.yml in the documentation source code, and would also need access to the TechDocs backend API.
Recommendation
Update the @backstage/techdocs-common package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.6.3
- Patched version(s): 0.6.3
References
Could your website be exposed too?
SmartScanner can check your website for Path traversal and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Path traversal in Node-RED-Dashboard - CVE-2021-3223
- Path traversal in url-parse - CVE-2021-27515
- MJML vulnerable to path traversal - CVE-2020-12827
- nanotar is vulnerable to path traversal in parseTar() and parseTarGzip() - CVE-2025-69874
You might also like:
See something that needs correcting? Let us knowUpdated February 01, 2023