CVE-2026-106507

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.15.4

Description The @backstage/plugin-techdocs-node package contains an arbitrary file read flaw. Unsafe path resolution during the handling of the TechDocs source tree allows an authenticated user with permissions to register documentation sources to include content from outside the intended documentation boundary. This may expose files that are readable by the build process, depending on the deployment configuration.

Recommendations Update to version 1.15.4.