# CVE-2026-106560: Backstage plugin-scaffolder-backend-module-confluence-to-markdown path traversal

Source: https://junglewise.ai/threats/cve-2026-106560-backstage-improper-repository-path-validation-in-a-scaffolder  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-07. Updated: 2026-10-07  
License: CC BY 4.0 with a link back

CVE-2026-106560 · Severity: high · CVSS 7.1 · Published 2026-10-07

Backstage is a platform for managing internal developer portals and infrastructure automation. A flaw in the Confluence-to-Markdown scaffolder module allows authenticated users to write files outside the intended workspace directory, potentially modifying or compromising the backend system. This could lead to unauthorized file creation or modification within areas the Backstage process can access.

Technologies: [Linuxfoundation Backstage\](https://junglewise.ai/threats/technologies/backstage). Vendors: [Backstage](https://junglewise.ai/threats/vendors/backstage), [Linuxfoundation](https://junglewise.ai/threats/vendors/linuxfoundation), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-106560 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106560 being exploited in the wild.

**How severe is CVE-2026-106560?** High severity, with a CVSS score of 7.1, published 7 October 2026.

**Which products and versions are affected?** Backstage Plugin-Scaffolder-Backend-Module-Confluence-To-Markdown < 0.3.25; @backstage/plugin-scaffolder-backend-module-confluence-to-markdown (npm) < 0.3.25, SEMVER:introduced=0,fixed=0.3.25.

**Is there a fix for CVE-2026-106560?** Yes. @backstage/plugin-scaffolder-backend-module-confluence-to-markdown (npm): upgrade to 0.3.25 or later. Until then: Restrict execution of templates using the affected action to trusted users, or remove and disable the affected action until the patched version is deployed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-106560 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-106560?** Check whether you run Backstage Plugin-Scaffolder-Backend-Module-Confluence-To-Markdown, Linuxfoundation Backstage\, Linuxfoundation Plugin-Scaffolder-Backend-Module-Confluence-To-Markdown or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @backstage/plugin-scaffolder-backend-module-confluence-to-markdown (npm): upgrade to 0.3.25 or later

  ```sh
  npm install @backstage/plugin-scaffolder-backend-module-confluence-to-markdown@0.3.25
  ```


Restrict execution of templates using the affected action to trusted users, or remove and disable the affected action until the patched version is deployed.

## Technical details

A path traversal vulnerability (CWE-22) in the Confluence-to-Markdown scaffolder backend module fails to properly validate repository file paths, allowing an authenticated user with template execution permission to escape the task workspace. By controlling the repository file location parameter, an attacker can write generated content to arbitrary locations writable by the Backstage backend process, affecting both system integrity and availability.

## Affected products

- Backstage plugin-scaffolder-backend-module-confluence-to-markdown < 0.3.25

## Identifiers

- CVE-2026-106560
- GHSA-2cmg-v53w-8xfp

## Timeline

- 2026-08-28: disclosed
- 2026-10-07: advisory
- 2026-10-07: patched

## References

- [https://github.com/backstage/backstage/security/advisories/GHSA-2cmg-v53w-8xfp](https://github.com/backstage/backstage/security/advisories/GHSA-2cmg-v53w-8xfp)

## Related threats

- [Backstage improper entity validation in Kubernetes services endpoint](https://junglewise.ai/threats/cve-2026-106563-backstage-improper-entity-validation-in-deprecated-kubernetes)
- [Backstage incorrect authorization in search engine permission filtering](https://junglewise.ai/threats/cve-2026-106562-backstage-has-incorrect-authorization-in-search-engine)
- [Backstage Kubernetes plugin sensitive information disclosure in resource queries](https://junglewise.ai/threats/cve-2026-106561-backstage-has-a-sensitive-information-disclosure-in-kubernetes)
- [Backstage Confluence to Markdown scaffolder input validation bypass](https://junglewise.ai/threats/cve-2026-106559-backstage-improper-input-validation-in-confluence-to-markdown)
- [Backstage plugin-auth-backend OAuth redirect_uri allowlist bypass](https://junglewise.ai/threats/cve-2026-73563-backstage-plugin-auth-backend-oauth-redirect-uri-allowlist-bypass)