The vulnerability is an improper validation in the MkDocs plugin configuration for Backstage’s TechDocs component. An attacker with authenticated write access to a TechDocs source repository can insert a MkDocs plugin reference that points to an arbitrary network location. When the build runs, the system retrieves data from that location and publishes it as part of the documentation, potentially exposing remote data or injecting malicious content. The weakness is classed as CWE‑918 (Remote File Inclusion).

Backstage platforms that use the @backstage/plugin-techdocs-node package from version 0.11.12 through 1.14.7 and 1.15.5 are affected. The core backstage framework is also impacted because the plugin is bundled within it.

The CVSS score of 7.7 reflects high risk. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker have authenticated write access to the source repository and trigger a build in which the build environment can resolve the injected URL. If those conditions are met, the attacker can result in data disclosure or unwanted content being published; the description does not confirm that the build will execute arbitrary code.