CVE-2026-106560

{
  "etk_id": "ETK-2026-959",
  "cve_id": "CVE-2026-106560",
  "display_id": "CVE-2026-106560",
  "ghsa_id": "GHSA-2cmg-v53w-8xfp",
  "euvd_id": "EUVD-2026-94373",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Repository path validation flaw in Backstage scaffolder module",
  "summary": "The Backstage Confluence-to-Markdown scaffolder backend module inadequately validates repository-derived file paths. An authenticated user permitted to run an affected template and control its repository file location could cause generated files to be placed outside the task workspace in backend-writable locations.",
  "mitigation": "Upgrade Backstage to 1.54.6 and @backstage/plugin-scaffolder-backend-module-confluence-to-markdown to 0.3.25. Until deployment, limit affected template execution to trusted users or disable the affected action.",
  "vendor": "backstage",
  "product": "backstage",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 0.3.25"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "0.3.25"
      ],
      "package_name": "@backstage/plugin-scaffolder-backend-module-confluence-to-markdown",
      "purl": "pkg:npm/@backstage/plugin-scaffolder-backend-module-confluence-to-markdown"
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
  "epss_score": 0.0031,
  "epss_percentile": 0.2294,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 12.28401065,
  "t0_at": "2026-10-07T14:50:25.384000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-07T14:50:25.384000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-07T14:50:25.384000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106560"
    }
  }
}