Improper Repository Path Validation in Backstage Scaffolder Backend Module

Backstage, an open platform for building developer portals, contains a path traversal vulnerability in the Scaffolder backend module @backstage/plugin-scaffolder-backend-module-confluence-to-markdown. The vulnerability, tracked as CVE-2026-106560, stems from improper validation of repository file location inputs provided by users. An authenticated attacker who can execute affected templates and control repository path parameters can escape the restricted task workspace. By manipulating these paths, the attacker can force the Backstage backend process to write files into any directory on the server that the backend process has permissions to access. This can lead to arbitrary file creation or overwriting of configuration files, potentially facilitating further system compromise or persistent unauthorized access. The issue was addressed in version 0.3.25 of the affected module.

Impact

Successful exploitation allows authenticated users to bypass directory restrictions within the Scaffolder environment. This vulnerability impacts organizations hosting Backstage instances that utilize the affected Confluence-to-Markdown Scaffolder action. An attacker could overwrite critical application files or drop web shells if the backend process runs with elevated privileges, leading to full application compromise or unauthorized data modification.

Recommendation

• Upgrade the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package to version 0.3.25 or later.
• Implement access control restrictions to limit which users can execute templates that utilize the Confluence-to-Markdown action until the update is deployed.
• Audit logs for the Backstage backend process to identify suspicious template execution attempts involving unusual file paths (e.g., paths containing '..').