GitHub Advisoryadvisory · npm

GHSA-75qf-886x-5xf2 Backstage: Improper input validation in Confluence to Markdown scaffolder module

MEDIUM Published 2026-10-07 Modified 2026-10-07 Official page ↗
Aliases
CVE-2026-106559
Ecosystem
npm
Packages
@backstage/plugin-scaffolder-backend-module-confluence-to-markdown
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
Weaknesses
CWE-22, CWE-73
Reviewed
2026-10-07

Affected packages

• npm @backstage/plugin-scaffolder-backend-module-confluence-to-markdown: < 0.3.25 → fixed in 0.3.25

Description

Impact Insufficient input validation in the Confluence to Markdown scaffolder module could allow an attacker to influence file write operations during template execution. Exploitation requires a Backstage user to run a template that processes attacker-influenced Confluence content. Patches Patched in `@backstage/plugin-scaffolder-backend-module-confluence-to-markdown` version `0.3.25` Workarounds If unable to update immediately: • Restrict Confluence edit access to trusted users. • Review Confluence page content before running scaffolder templates against untrusted pages.

Related

Alias · CVE (1)

  • CVE-2026-106559 Backstage is an open framework for building developer portals. vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-73 External Control of File Name or Path weakness

References