CVE-2026-106559 · GHSA-75qf-886x-5xf2
Backstage: Improper input validation in Confluence to Markdown scaffolder module
- Risk score
- 49/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 7 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper input validation in confluence to markdown scaffolder module. Insufficient input validation in the Confluence to Markdown scaffolder mod…
- Affected
- @backstage/plugin-scaffolder-backend-module-confluence-to-markdown (npm) < 0.3.25
- Fix
- Upgrade @backstage/plugin-scaffolder-backend-module-confluence-to-markdown to 0.3.25 or later.
- Exploitation
- No known exploitation
Story map
At a glance
@backstage/plugin-scaffolder-backend-module-confluence-to-markdown: Yellow, plan it in. Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper input validation in confluence to markdown scaffolder module. Insufficient input validation in the Confluence to Markdown scaffolder mod…
The flaws
- CVE-2026-106559: Backstage: Improper input validation in Confluence to Markdown scaffolder module (CVSS 6.5 · EPSS 0%)
- CVE-2026-106560: Backstage: Improper repository path validation in a Scaffolder backend module (CVSS 6.5 · EPSS 0%)
The fix
Upgrade @backstage/plugin-scaffolder-backend-module-confluence-to-markdown: 0.3.25 or later on your release line
Who is exposed: @backstage/plugin-scaffolder-backend-module-confluence-to-markdown (npm) < 0.3.25
Where it stands
- No known exploitation
Connects to
- Same weakness: Path traversal (CWE-22). 398 other warnings in 30 days
Why it is Yellow
- CVSS 6.5 medium
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| @backstage/plugin-scaffolder-backend-module-confluence-to-markdown | npm | < 0.3.25 | 0.3.25 |
References
- https://github.com/advisories/GHSA-75qf-886x-5xf2
- https://github.com/backstage/backstage/security/advisories/GHSA-75qf-886x-5xf2
- https://nvd.nist.gov/vuln/detail/CVE-2026-106559
- https://github.com/backstage/backstage/commit/506c2c11bce3ed9d1f8f50de5d6474b16e43a65e
- https://github.com/backstage/backstage/releases/tag/v1.54.6
- https://github.com/advisories/GHSA-75qf-886x-5xf2
Original description
Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper input validation in confluence to markdown scaffolder module. Insufficient input validation in the Confluence to Markdown scaffolder module could allow an attacker to influence file write operations during template execution. Exploitation requires a Backstage user to run a template that processes attacker-influenced Confluence content. This issue is fixed in version 0.3.25.
Last activity 7 Oct 2026. Patch Forecast updates every hour.