A path traversal flaw in @backstage/plugin-techdocs-node allows an attacker who can supply documentation containing symbolic links to read any files on the host filesystem when the local generator is enabled. The extracted file contents are embedded into the generated HTML, making them accessible to any user who views the documentation, thereby exposing potentially confidential data. The vulnerability stems from missing sanitization of symlink paths and is classified as CWE-22.

The vulnerability affects the Backstage framework, specifically the @backstage/plugin-techdocs-node component. Versions prior to 1.13.11 and 1.14.1 are vulnerable; the fix is included in those and later releases.

The CVSSv3 score is 5.3, indicating a moderate impact. The EPSS score is less than 1 %, suggesting low current exploitation probability. The flaw is not listed in CISA’s KEV catalog. Exploitation requires Backstage to be configured with "techdocs.generator.runIn: local" and an attacker to be able to supply the documentation to be built, typically through access to the source repository. Once the generator processes untrusted docs, it follows symlinks and reads the target files, which are then returned in the generated site.