GHSA-4jqc-jvh2-pxg9
Path traversal for local publishers in TechDocs backend
GHSA-4jqc-jvh2-pxg9 is a vulnerability with no CVSS score yet in @backstage/plugin-techdocs-node, published June 17, 2022. No source lists public exploit code. Fixed in @backstage/plugin-techdocs-node 1.1.2.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.1.2@backstage/plugin-techdocs-node +1 more
Description
Impact
A malicious actor with the ability to register entities in the Software Catalog is able to write files to arbitrary paths on the techdocs backend host instance when techdocs.publisher.type is set to local.
This vulnerability is mitigated by the fact that the Software Catalog must be configured with non-standard field format validators and/or non-standard entity policies.
Patches
Those affected are advised to upgrade to @backstage/plugin-techdocs-node version 1.1.2 or higher.
Workarounds
If patching or upgrading is not possible, it would be sufficient to update any custom Catalog field format validators and/or custom entity policies to disallow entity names, kinds, and namespaces containing ..
<!-- ### References todo: Link to blog post / published report. -->
For more information
If you have any questions or comments about this advisory:
- Open an issue in the Backstage repository
- Visit our chat, linked to in the Backstage README
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@backstage/plugin-techdocs-nodenpm | before 1.1.2 | 1.1.2 |
@backstage/techdocs-commonnpm | before 0.11.16 | 0.11.16 |
What each source reports
GitHub AdvisoriesNo score
Path traversal for local publishers in TechDocs backend
Impact
A malicious actor with the ability to register entities in the Software Catalog is able to write files to arbitrary paths on the techdocs backend host instance when techdocs.publisher.type is set to local.
This vulnerability is mitigated by the fact that the Software Catalog must be configured with non-standard field format validators and/or non-standard entity policies.
Patches
Those affected are advised to upgrade to @backstage/plugin-techdocs-node version 1.1.2 or higher.
Workarounds
If patching or upgrading is not possible, it would be sufficient to update any custom Catalog field format validators and/or custom entity policies to disallow entity names, kinds, and namespaces containing ..
<!-- ### References todo: Link to blog post / published report. -->
For more information
If you have any questions or comments about this advisory:
- Open an issue in the Backstage repository
- Visit our chat, linked to in the Backstage README
- Record
GHSA-4jqc-jvh2-pxg9- Updated
- 2026-11-02
OSVNo score
Path traversal for local publishers in TechDocs backend
Impact
A malicious actor with the ability to register entities in the Software Catalog is able to write files to arbitrary paths on the techdocs backend host instance when techdocs.publisher.type is set to local.
This vulnerability is mitigated by the fact that the Software Catalog must be configured with non-standard field format validators and/or non-standard entity policies.
Patches
Those affected are advised to upgrade to @backstage/plugin-techdocs-node version 1.1.2 or higher.
Workarounds
If patching or upgrading is not possible, it would be sufficient to update any custom Catalog field format validators and/or custom entity policies to disallow entity names, kinds, and namespaces containing ..
<!-- ### References todo: Link to blog post / published report. -->
For more information
If you have any questions or comments about this advisory:
- Open an issue in the Backstage repository
- Visit our chat, linked to in the Backstage README
- Record
GHSA-4jqc-jvh2-pxg9- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.