CVE-2026-106560 backstage CVE debrief

Who should care

Backstage administrators and developers using the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package should assess exposure and prioritize remediation. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Additionally, they should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed, and review compensatingcontrols

Why it matters

CVE-2026-106560 allows authenticated users to write generated content outside the task workspace in Backstage deployments using the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package. Defenders should assess exposure, prioritize remediation, and monitor for suspicious activity.

• Potential unauthorized file writes within the Backstage backend process workspace
• Possible data integrity issues due to generated content written outside task workspace
• Need for verification of current version and exposure to vulnerable template execution

Technical summary

The @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package prior to version 0.3.25 is vulnerable to improper repository path validation. An authenticated user who can execute an affected template and control its repository file location may cause generated content to be written outside the task workspace, within locations writable by the Backstage backend process. This vulnerability allows potential unauthorized file writes within the Backstage backend process workspace and possible data integrity issues due to generated content written outside the task workspace. Defenders should assess exposure, prioritize remediation, and monitor for suspicious activity.

Defensive priority

Assess exposure and prioritize remediation for Backstage deployments using the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package, especially where authenticated users can execute templates.

Recommended defensive actions

• Assess exposure by reviewing Backstage deployments for the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package
• Prioritize remediation for deployments where authenticated users can execute templates
• Verify version 0.3.25 or later is deployed
• Monitor for suspicious template execution activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the improper repository path validation vulnerability in the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package. The issue allows authenticated users to write generated content outside the task workspace.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.