CVE-2021-32662

Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In `@backstage/techdocs-common` versions prior to 0.6.3, a malicious actor could read sensitive files from the environment where TechDocs documentation is built and published by setting a particular path for `docs_dir` in `mkdocs.yml`. These files would then be available over the TechDocs backend API. This vulnerability is mitigated by the fact that an attacker would need access to modify the `mkdocs.yml` in the documentation source code, and would also need access to the TechDocs backend API. The vulnerability is patched in the `0.6.3` release of `@backstage/techdocs-common`.

• CWE-22

• https://github.com/backstage/backstage/commit/8cefadca04cbf01d0394b0cb1983247e5f1d6208Patch, Third Party Advisory
• https://github.com/backstage/backstage/releases/tag/release-2021-05-27Release Notes, Third Party Advisory
• https://github.com/backstage/backstage/security/advisories/GHSA-pgf8-28gg-vpr6Third Party Advisory
• https://github.com/backstage/backstage/commit/8cefadca04cbf01d0394b0cb1983247e5f1d6208Patch, Third Party Advisory
• https://github.com/backstage/backstage/releases/tag/release-2021-05-27Release Notes, Third Party Advisory
• https://github.com/backstage/backstage/security/advisories/GHSA-pgf8-28gg-vpr6Third Party Advisory

Published

Jun 3, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32656Nextcloud Server is a Nextcloud package that handles data st…8.6
• CVE-2021-32657Nextcloud Server is a Nextcloud package that handles data st…4.3
• CVE-2021-32658Nextcloud Android is the Android client for the Nextcloud op…4.6
• CVE-2021-32659Matrix-appservice-bridge is the bridging service for the Mat…4.9
• CVE-2021-32660Backstage is an open platform for building developer portals…8.1
• CVE-2021-32661Backstage is an open platform for building developer portals…7.3
• CVE-2021-32663iTop is an open source web based IT Service Management tool.…7.5
• CVE-2021-32664Combodo iTop is an open source web based IT Service Manageme…4.8
• CVE-2021-32665wire-ios is the iOS version of Wire, an open-source secure m…6.5
• CVE-2021-32666wire-ios is the iOS version of Wire, an open-source secure m…6.5
• CVE-2021-32667TYPO3 is an open source PHP based web content management sys…5.4
• CVE-2021-32668TYPO3 is an open source PHP based web content management sys…4.8