Multiple security vulnerabilities have been identified in Backstage's Confluence to Markdown Scaffolder backend module, affecting template execution and file-write behavior in affected deployments. The flaws allow authenticated users with template execution rights to influence how generated content is written during scaffolder operations. The combination creates a risk of unauthorized file placement and integrity impact on backend systems that rely on the module.
CVE-2026-106560 (CVSS 7.1 — High): Improper repository path validation in the Confluence to Markdown Scaffolder backend module allows an authenticated user who can execute an affected template and control its repository file location to cause generated content to be written outside the task workspace, within locations writable by the Backstage backend process.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in Backstage's Confluence to Markdown Scaffolder backend module, affecting template execution and file-write behavior in affected deployments. The flaws allow authenticated users with template execution rights to influence how generated content is written during scaffolder operations. The combination creates a risk of unauthorized file placement and integrity impact on backend systems that rely on the module.
CVE-2026-106560 (CVSS 7.1 — High): Improper repository path validation in the Confluence to Markdown Scaffolder backend module allows an authenticated user who can execute an affected template and control its repository file location to cause generated content to be written outside the task workspace, within locations writable by the Backstage backend process.[emaillocker id="1283"]
CVE-2026-106559 (CVSS 6.3 — Medium): Insufficient input validation in the Confluence to Markdown Scaffolder module can allow an attacker to influence file write operations during template execution when a Backstage user runs a template that processes attacker-influenced Confluence content.
We recommend you to update @backstage/plugin-scaffolder-backend-module-confluence-to-markdown to version 0.3.25 or later.
The following reports contain further technical details:
[/emaillocker]