Skip to content

Product

backstage @backstage/techdocs-common vulnerabilities

3 published CVES affecting backstage @backstage/techdocs-common, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
0
High
1
Medium
1
Low
0
Unscored
1
CISA KEV
0

Latest backstage @backstage/techdocs-common CVEs

Newest publication first

  1. GHSA-4jqc-jvh2-pxg9 Path traversal for local publishers in TechDocs backend

    Published
    Unknown

    Impact A malicious actor with the ability to register entities in the Software Catalog is able to write files to arbitrary paths on the techdocs backend host instance when techdocs.publisher.type is set to local. This vulnerability is mitigated by the fact that the Software Catal...

  2. CVE-2021-32662 TechDocs mkdocs.yml path traversal

    Published
    MediumCVSS 6.5 EPSS 1.3%

    Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In @backstage/techdocs-common versions prior to 0.6.3, a malicious actor could read sensitive files from the environment where TechDocs docu...

  3. CVE-2021-32660 TechDocs content sanitization bypass

    Published
    HighCVSS 8.1 EPSS 1.3%

    Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In versions of @backstage/tehdocs-common prior to 0.6.4, a malicious internal actor is able to upload documentation content with malicious s...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.