🛡️ GHSA-4jqc-jvh2-pxg9 — plugin-techdocs-node

⚪ Unknown ✅ No Known Exploit OSV

N/A

CVSS Score

0 Low4 Medium7 High9 Critical10

Description

Path traversal for local publishers in TechDocs backend

Impact

A malicious actor with the ability to register entities in the Software Catalog is able to write files to arbitrary paths on the techdocs backend host instance when techdocs.publisher.type is set to local.

This vulnerability is mitigated by the fact that the Software Catalog must be configured with non-standard field format validators and/or non-standard entity policies.

Patches

Those affected are advised to upgrade to @backstage/plugin-techdocs-node version 1.1.2 or higher.

Workarounds

If patching or upgrading is not possible, it would be sufficient to update any custom Catalog field format validators and/or custom entity policies to disallow entity names, kinds, and namespaces containing ..

<!--

References

todo: Link to blog post / published report.

-->

For more information

If you have any questions or comments about this advisory:

Open an issue in the [Backstage repository](https://github.com/backstage/backstage)
Visit our chat, linked to in the [Backstage README](https://github.com/backstage/backstage)

Affected software

GHSA-4jqc-jvh2-pxg9 is recorded against 2 packages.

@backstage/plugin-techdocs-node
@backstage/techdocs-common

Timeline and source

Published on 17 June 2022. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

github.com (Web)
github.com (Web)
github.com (Package)

Details

Severity Unknown

CVSS Score N/A

CVSS Vector N/A

CWE N/A

Public Exploit ✅ No

Source OSV

Published 2022-06-17

Updated 2026-08-20

Modified 2022-06-17

Fix URL N/A

Affected Packages

Software	From version	Fixed in
@backstage/plugin-techdocs-node	—	—
@backstage/techdocs-common	—	—

References

WEB https://github.com/backstage/backstage/security/advisories/GHSA-4jqc-jvh2-pxg9

WEB https://github.com/backstage/backstage/commit/429c9f9daa5654dd1b996aa85f7264eb23a2e4fa

PACKAGE https://github.com/backstage/backstage

🔗 NVD 🔗 Mitre

Similar Threats

Free Vulnerability Check

Is your site affected by GHSA-4jqc-jvh2-pxg9?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against GHSA-4jqc-jvh2-pxg9 and other known CVE records.

Scan My Site Free →

No credit card required · Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.