{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/backend-security/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:backstage:plugin-scaffolder-backend-module-confluence-to-markdown:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-106560"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["plugin-scaffolder-backend-module-confluence-to-markdown (\u003c 0.3.25)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","path-traversal","backend-security"],"_cs_type":"advisory","_cs_vendors":["Backstage"],"content_html":"\u003cp\u003eBackstage, an open platform for building developer portals, contains a path traversal vulnerability in the Scaffolder backend module \u003ccode\u003e@backstage/plugin-scaffolder-backend-module-confluence-to-markdown\u003c/code\u003e. The vulnerability, tracked as CVE-2026-106560, stems from improper validation of repository file location inputs provided by users. An authenticated attacker who can execute affected templates and control repository path parameters can escape the restricted task workspace. By manipulating these paths, the attacker can force the Backstage backend process to write files into any directory on the server that the backend process has permissions to access. This can lead to arbitrary file creation or overwriting of configuration files, potentially facilitating further system compromise or persistent unauthorized access. The issue was addressed in version 0.3.25 of the affected module.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated users to bypass directory restrictions within the Scaffolder environment. This vulnerability impacts organizations hosting Backstage instances that utilize the affected Confluence-to-Markdown Scaffolder action. An attacker could overwrite critical application files or drop web shells if the backend process runs with elevated privileges, leading to full application compromise or unauthorized data modification.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003e@backstage/plugin-scaffolder-backend-module-confluence-to-markdown\u003c/code\u003e package to version 0.3.25 or later.\u003c/li\u003e\n\u003cli\u003eImplement access control restrictions to limit which users can execute templates that utilize the Confluence-to-Markdown action until the update is deployed.\u003c/li\u003e\n\u003cli\u003eAudit logs for the Backstage backend process to identify suspicious template execution attempts involving unusual file paths (e.g., paths containing '..').\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-07T22:54:45Z","date_published":"2026-10-07T22:54:45Z","id":"https://feed.craftedsignal.io/briefs/2026-10-07-backstage-path-traversal/","summary":"An authenticated user can exploit improper path validation in the Backstage plugin-scaffolder-backend-module-confluence-to-markdown (CVE-2026-106560) to write files outside the designated task workspace.","title":"Improper Repository Path Validation in Backstage Scaffolder Backend Module","url":"https://feed.craftedsignal.io/briefs/2026-10-07-backstage-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Backend-Security","version":"https://jsonfeed.org/version/1.1"}