Is CVE-2026-106560 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106560 being exploited in the wild.

How severe is CVE-2026-106560?

High severity, with a CVSS score of 7.1, published 7 October 2026.

Which products and versions are affected?

Backstage Plugin-Scaffolder-Backend-Module-Confluence-To-Markdown < 0.3.25; @backstage/plugin-scaffolder-backend-module-confluence-to-markdown (npm) < 0.3.25, SEMVER:introduced=0,fixed=0.3.25.

How is CVE-2026-106560 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-106560?

Check whether you run Backstage Plugin-Scaffolder-Backend-Module-Confluence-To-Markdown, Linuxfoundation Backstage\, Linuxfoundation Plugin-Scaffolder-Backend-Module-Confluence-To-Markdown or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106560: Backstage plugin-scaffolder-backend-module-confluence-to-markdown path traversal

Q: Is there a fix for CVE-2026-106560?

Yes. @backstage/plugin-scaffolder-backend-module-confluence-to-markdown (npm): upgrade to 0.3.25 or later. Until then: Restrict execution of templates using the affected action to trusted users, or remove and disable the affected action until the patched version is deployed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-106560 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-106560?

Check whether you run Backstage Plugin-Scaffolder-Backend-Module-Confluence-To-Markdown, Linuxfoundation Backstage\, Linuxfoundation Plugin-Scaffolder-Backend-Module-Confluence-To-Markdown or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106560 · Severity: high · CVSS 7.1 · Published 2026-10-07

Backstage is a platform for managing internal developer portals and infrastructure automation. A flaw in the Confluence-to-Markdown scaffolder module allows authenticated users to write files outside the intended workspace directory, potentially modifying or compromising the backend system. This could lead to unauthorized file creation or modification within areas the Backstage process can access.

Technologies: Linuxfoundation Backstage\. Vendors: Backstage, Linuxfoundation, npm.

Quick answers

Is CVE-2026-106560 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106560 being exploited in the wild.
How severe is CVE-2026-106560?: High severity, with a CVSS score of 7.1, published 7 October 2026.
Which products and versions are affected?: Backstage Plugin-Scaffolder-Backend-Module-Confluence-To-Markdown < 0.3.25; @backstage/plugin-scaffolder-backend-module-confluence-to-markdown (npm) < 0.3.25, SEMVER:introduced=0,fixed=0.3.25.
Is there a fix for CVE-2026-106560?: Yes. @backstage/plugin-scaffolder-backend-module-confluence-to-markdown (npm): upgrade to 0.3.25 or later. Until then: Restrict execution of templates using the affected action to trusted users, or remove and disable the affected action until the patched version is deployed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106560 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-106560?: Check whether you run Backstage Plugin-Scaffolder-Backend-Module-Confluence-To-Markdown, Linuxfoundation Backstage\, Linuxfoundation Plugin-Scaffolder-Backend-Module-Confluence-To-Markdown or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@backstage/plugin-scaffolder-backend-module-confluence-to-markdown (npm): upgrade to 0.3.25 or later
```
npm install @backstage/plugin-scaffolder-backend-module-confluence-to-markdown@0.3.25
```

Restrict execution of templates using the affected action to trusted users, or remove and disable the affected action until the patched version is deployed.

Technical details

A path traversal vulnerability (CWE-22) in the Confluence-to-Markdown scaffolder backend module fails to properly validate repository file paths, allowing an authenticated user with template execution permission to escape the task workspace. By controlling the repository file location parameter, an attacker can write generated content to arbitrary locations writable by the Backstage backend process, affecting both system integrity and availability.

Affected products

Backstage plugin-scaffolder-backend-module-confluence-to-markdown < 0.3.25

Identifiers

CVE-2026-106560
GHSA-2cmg-v53w-8xfp

Timeline

2026-08-28: disclosed
2026-10-07: advisory
2026-10-07: patched

References

https://github.com/backstage/backstage/security/advisories/GHSA-2cmg-v53w-8xfp

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.