CVE WatchJul 15, 2026

CVE-2026-29186

Backstage is an open framework for building developer portals. Prior to version 1.14.3, this is a configuration bypass vulnerability that en

CVSS

7.7

High

EPSS

0.8%

p52

KEV

—

Exploit Today

0-100

Published: Mar 7, 2026 · Last modified: Jul 15, 2026 · CWE-74 · CWE-434 · CWE-791

EPSS · 30d

0.8%EPSS · 30 days0.8%

2026-06-302026-07-16

Technical description

Backstage is an open framework for building developer portals. Prior to version 1.14.3, this is a configuration bypass vulnerability that enables arbitrary code execution. The @backstage/plugin-techdocs-node package uses an allowlist to filter dangerous MkDocs configuration keys during the documentation build process. A gap in this allowlist allows attackers to craft an mkdocs.yml that causes arbitrary Python code execution, completely bypassing TechDocs' security controls. This issue has been patched in version 1.14.3.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-562909.8 CRI

85.4%

KEV—76Joomlack Page Builder Improper Access Control Vulnerability9d CVE-2026-489089.8 CRI

72.6%

KEV—72JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability9d CVE-2026-489399.8 CRI

71.5%

KEV—71iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability6d CVE-2026-562919.8 CRI

53.6%

KEV—66Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability6d CVE-2026-222007.5 HIG

99.4%

——30Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficiently sanitized before being processed by the mPDF PDF generator during export. When the attacker exports the ticket to PDF, the generated PDF can embed the contents of attacker-selected files from the server filesystem as bitmap images, allowing disclosure of sensitive local files in the context of the osTicket application user. This issue is exploitable in default configurations where guests may create tickets and access ticket status, or where self-registration is enabled.3d CVE-2023-388368.8 HIG

99.3%

——30File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks.8d