CVE-2026-106560
npm · @backstage/plugin-scaffolder-backend-module-confluence-to-markdown
Summary
Backstage: Improper repository path validation in a Scaffolder backend module
Advisory details
Impact
An authenticated user who can execute an affected template and control its repository file location may cause generated content to be written outside the task workspace, within locations writable by the Backstage backend process.
Patches
Patched in @backstage/plugin-scaffolder-backend-module-confluence-to-markdown version 0.3.25
Workarounds
- Restrict execution of templates using the affected action to trusted users.
- Remove or disable the affected action until the patched package is deployed.
References
- https://github.com/advisories/GHSA-2cmg-v53w-8xfp
- https://github.com/backstage/backstage/security/advisories/GHSA-2cmg-v53w-8xfp
- https://nvd.nist.gov/vuln/detail/CVE-2026-106560
- https://github.com/backstage/backstage/commit/5f0000c1d0af05571e357926b3fa33a453337ff0
- https://github.com/backstage/backstage/releases/tag/v1.54.6
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-104102
copyparty FTP: upload outside defined volumes (limited path traversal)
- MEDIUMCVE-2026-84320
Nginx UI: Auto backup name allows path traversal outside validated storage path
- MEDIUMCVE-2026-108258
Shiny for Python has path traversal in bookmark restore
- MEDIUMCVE-2026-107844
Contao: Path traversal in the images controller
- HIGHGHSA-fr26-jjhm-638c
pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)
- MEDIUMCVE-2026-107716
Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry