Résumé
Backstage: Improper input validation in TechDocs static content requests
Détails de l’avis
Impact
When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure.
Patches
Patched in @backstage/plugin-techdocs-backend version 2.2.4
Workarounds
- Restrict access to the TechDocs backend to users who are permitted to view all stored documentation until an upgrade can be applied.
- Keep the default backend authentication policy enabled.
Références
- https://github.com/advisories/GHSA-7mfx-xg57-53c9
- https://github.com/backstage/backstage/security/advisories/GHSA-7mfx-xg57-53c9
- https://nvd.nist.gov/vuln/detail/CVE-2026-106490
- https://github.com/backstage/backstage/commit/40ecc4c2e88b0218125b0a3405d1f6315b321974
- https://github.com/backstage/backstage/releases/tag/v1.54.6
Vulnérabilités liées
Tout Supply chain →- HIGHGHSA-5rmq-chc7-m22f
Vibe-Trading file-read tools expose arbitrary server-readable files
- MEDIUMCVE-2026-59149
@Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)
- MEDIUMCVE-2026-50024
GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server
- HIGHCVE-2026-63490
Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass
- HIGHCVE-2026-59832
Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db
- MEDIUMCVE-2026-104102
copyparty FTP: upload outside defined volumes (limited path traversal)