CVE-2026-106557

Executive Summary

CVE-2026-106557 is a path traversal / insufficient validation vulnerability (CWE-22) in the Backstage @backstage/plugin-techdocs-node package, affecting versions prior to 1.14.6 and 1.15.4. An authenticated user who can register or modify documentation sources can cause a TechDocs build to access resources outside the intended documentation boundary, potentially exposing backend host data or internal network resources. Impact is high for confidentiality (CVSS 7.7) because a compromised or malicious documentation source can read data beyond the documented root and reach internal services, though there is no direct integrity or availability impact.

Technical Analysis

Backstage is an open framework for building developer portals, and TechDocs is its documentation subsystem. The @backstage/plugin-techdocs-node package handles the Node.js side of TechDocs build orchestration. According to the NVD description, the package "did not sufficiently validate TechDocs Markdown extension configuration."

The core mechanism is a validation gap on Markdown extension configuration used during the TechDocs build process. Because the extension configuration is not properly constrained, a user with the ability to register or modify documentation sources can supply configuration that causes the build to resolve and access resources located outside the intended documentation boundary — that is, outside the directory tree the build is supposed to operate within. This is a systemic or scope-changing traversal issue: the impact crosses a trust boundary (CVSS scope is marked Changed: S:C), meaning the vulnerable component affects resources beyond its own security authority.

Two elements of the fix are relevant:

• The Node.js package @backstage/plugin-techdocs-node was updated in 1.14.6 and 1.15.4 to validate the Markdown extension configuration adequately.
• The description states the issue is fixed "when pymdown-extensions 10.21.3 or later is also used, normally through mkdocs-techdocs-core 1.7.0 or later." This indicates the TechDocs build invokes a MkDocs-based toolchain that relies on Python's pymdown-extensions; the traversal behavior can be influenced or enabled through that dependency as well. Consequently, remediation requires both the Node package upgrade and the updated pymdown-extensions/mkdocs-techdocs-core version.

Authentication is required (PR:L) and no user interaction is needed (UI:N). The attack is network-accessible (AV:N) with low complexity (AC:L). Note that "authenticated user who can register or modify documentation sources" is a broad set in many Backstage deployments, where catalog entities and their documentation sources may be created by engineering teams beyond a small admin group. No public PoC, exploit code, or Nuclei template is known as of this writing, and EPSS has not yet scored the CVE; the attack chain described below is inferred from the vulnerability class and the NVD description.

Insufficient technical detail is available in the NVD description to identify specific function names, code paths, URL endpoints, or configuration parameter names beyond those quoted above; this report deliberately avoids fabricating them.

Exploitation Scenarios

No public PoC is available; the following chain is inferred from the vulnerability class (CWE-22) and the NVD description.

1. Reconnaissance / target identification. The attacker identifies a Backstage deployment that uses TechDocs. Because the vulnerability requires the ability to register or modify documentation sources, the attacker first needs a valid authenticated account with permission to create or edit a catalog entity and its documentation source (e.g., a component owner or team member in a permissive Backstage catalog configuration). The attacker enumerates TechDocs-enabled entities and identifies how the TechDocs build pipeline resolves documentation source locations.

2. Triggering the flaw class. The attacker registers or modifies a documentation source whose Markdown extension configuration is crafted to point outside the intended documentation boundary. Because @backstage/plugin-techdocs-node prior to 1.14.6 / 1.15.4 does not sufficiently validate this configuration, the build accepts the out-of-boundary configuration and resolves resources outside the docs root. This is a path traversal / boundary-escape condition at the configuration level; no injected code is needed to reach the boundary itself.

3. Payload / execution method (vulnerability-class level). The "payload" is the malicious Markdown extension configuration attached to the documentation source. When the TechDocs build runs, it resolves the configuration and accesses backend-host files or internal network resources beyond the intended documentation directory. The exact configuration syntax is not specified in the NVD description and is not invented here.

4. Post-exploitation impact. Successful abuse results in disclosure of backend-host data (local files readable by the TechDocs build process) or exposure of internal network resources reachable from that host (for example, internal HTTP services), because the build's outbound and local access is no longer constrained to the documentation boundary. Confidentiality impact is high; there is no direct integrity or availability impact per the provided vector.

Impact Assessment

• Confidentiality (C:H): High. Backend-host data and internal network resources can be exposed to a low-privileged authenticated user who controls documentation sources.
• Integrity (I:N) / Availability (A:N): None per the CVSS vector; the flaw is information disclosure via boundary escape, not data modification or denial of service.
• Scope (S:C): Changed. The vulnerable component (TechDocs build) affects resources beyond its own security authority — the backend host and internal network.
• Attack requirements: Network-reachable, low complexity, low privileges, no user interaction. This makes it practical to exploit by any user who already has documentation-source write access.
• Blast radius: Any Backstage instance running an affected @backstage/plugin-techdocs-node version with a permissive catalog model where engineering teams can create/modify docs sources. Exposed data can include configuration files, credentials material on the backend host, and reachable internal services.
• Business impact: Potential leak of internal infrastructure detail, secrets in backend files, and internal service enumeration. In environments where Backstage runs with broad host access or in a shared backend network, this can escalate to lateral movement enablement.

Detection Guidance

Detection content below targets the TechDocs build and boundary-escape behavior at the vulnerability-class level. Because no public PoC or indicator set exists, rules are heuristic and may require environment-specific tuning.

Sigma Rule

title: Backstage TechDocs Potential Path Traversal via Markdown Extension Configuration
id: 8f3c2b1a-0d4e-4a6f-9c21-7b5e1d9a2f10
status: experimental
description: Detects TechDocs build activity against affected @backstage/plugin-techdocs-node versions consistent with CVE-2026-106557 boundary-escape behavior.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106557
author: valtersit.com
date: 2026/06/01
logsource:
  product: application
  service: backstage
detection:
  selection_pkg:
    ProcessCommandLine|contains|all:
      - 'techdocs'
      - 'mkdocs'
  selection_config:
    EventMessage|contains|any:
      - 'pymdown'
      - 'markdown_extensions'
      - 'mkdocs-techdocs-core'
  selection_traversal:
    EventMessage|contains|any:
      - '../'
      - '..\\'
      - '/etc/passwd'
      - '/proc/self/'
      - 'file://'
  condition: selection_pkg and selection_config and selection_traversal
falsepositives:
  - Legitimate TechDocs builds referencing relative paths in plugin config
level: medium
tags:
  - attack.t1213
  - cve.2026.106557

YARA Rule

rule CVE_2026_106557_Backstage_TechDocs_Traversal
{
    meta:
        description = "Detects TechDocs Markdown extension configuration attempting path boundary escape (CVE-2026-106557)"
        author = "valtersit.com"
        date = "2026-06-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106557"
        severity = "HIGH"
    strings:
        $mk1 = "markdown_extensions" ascii nocase
        $mk2 = "pymdown" ascii nocase
        $mk3 = "mkdocs-techdocs-core" ascii nocase
        $tr1 = "../" ascii
        $tr2 = "..\\" ascii
        $tr3 = "/etc/passwd" ascii
        $tr4 = "/proc/self/" ascii
        $tr5 = "file://" ascii nocase
    condition:
        (any of ($mk*)) and (any of ($tr*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106557 Backstage TechDocs boundary escape attempt"; \
  flow:established,to_server; \
  (http.uri; content:"techdocs"; nocase; content:"markdown"; nocase; content:".."; nocase;) \
  http_user_agent; content:"Backstage"; nocase; \
  sid:10655701; rev:1; \
  reference:cve,2026-106557; \
  classtype:attempted-recon;)

Elastic Detection

sequence by process.entity_id with maxspan=2m
  [process where process.name in ("node","mkdocs","python","python3") and process.command_line like~ "*techdocs*"]
  [file where file.path like~ "*../*" or file.path : ("/etc/passwd","/proc/self/*","/root/*")]

Splunk SPL Query

index=backstage OR index=application sourcetype=backstage:techdocs OR "techdocs"
("markdown_extensions" OR "pymdown" OR "mkdocs-techdocs-core")
("../" OR "..\\" OR "/etc/passwd" OR "/proc/self/" OR "file://")
| stats count values(message) by host, user, source
| where count > 0

Wazuh OSSEC Rule

<group name="backstage,techdocs,cve-2026-106557,">
  <rule id="106557" level="10">
    <decoded_as>json</decoded_as>
    <field name="message">techdocs</field>
    <field name="message">markdown_extensions|pymdown|mkdocs-techdocs-core</field>
    <regex>\.\./|\.\.\\|/etc/passwd|/proc/self/|file://</regex>
    <description>Possible Backstage TechDocs boundary escape attempt (CVE-2026-106557)</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The version numbers cited below come from the NVD description as the vendor-stated fix; they should be independently verified against upstream release notes before relying on them.

1. Immediate mitigations

   • Restrict who can register or modify documentation sources in the Backstage catalog. Tighten entity ownership and catalog write permissions so that untrusted or broad groups cannot supply documentation source configuration.
   • If TechDocs builds are not required, disable the TechDocs build pipeline for untrusted entities.
   • Run the TechDocs build worker with least privilege: a dedicated, unprivileged service account, restricted filesystem access (read-only where possible), and egress network filtering so the build cannot reach internal services outside a documented allowlist.
   • Isolate build execution (container, namespace, or sandbox) to contain any boundary escape and reduce lateral reach.

2. Patch / upgrade steps

   • Upgrade @backstage/plugin-techdocs-node to 1.14.6 or 1.15.4 (or later).
   • Ensure the Python toolchain uses pymdown-extensions 10.21.3 or later, normally obtained by upgrading mkdocs-techdocs-core to 1.7.0 or later.
   • Rebuild and redeploy affected Backstage instances so the updated Node package and MkDocs toolchain are both active; the description indicates both components matter.
   • Verify the installed versions are actually in effect in the running container/image and in any CI runners that build TechDocs.

3. Long-term hardening

   • Enforce strict input validation and path canonicalization on all build configuration that influences filesystem or network access, and reject configurations resolving outside the documentation root.
   • Maintain a techdocs build sandbox with no ambient credentials and restricted network egress as the default operating mode.
   • Monitor upstream Backstage, pymdown-extensions, and mkdocs-techdocs-core release channels for advisories and apply updates on a routine cadence.
   • Keep an SBOM of the Backstage deployment plus its Python build dependencies so affected versions can be identified quickly during future advisories.

References

• NVD — CVE-2026-106557: https://nvd.nist.gov/vuln/detail/CVE-2026-106557
• Backstage project / TechDocs documentation and release notes: https://backstage.io/docs/features/techdocs/
• @backstage/plugin-techdocs-node package (npm): https://www.npmjs.com/package/@backstage/plugin-techdocs-node
• pymdown-extensions project (Python): https://github.com/facelessuser/pymdown-extensions
• mkdocs-techdocs-core project: https://github.com/backstage/mkdocs-techdocs-core

Threat actor campaigns / exploit-in-the-wild: No evidence available. CISA KEV does not list this CVE; no public PoC, exploit code, or Nuclei template is known at this time; EPSS has not yet scored the CVE.