Plugin scaffolder backend module confluence to markdown: Backstage: Improper repository path validation in a Scaffolder backend module (CVE-2026-106560)

The vulnerability in '@backstage/plugin-scaffolder-backend-module-confluence-to-markdown' arises from improper validation of repository paths in the Scaffolder backend module. An authenticated user with permission to run an affected template can specify a repository file location that causes generated content to be written outside the designated task workspace. This can lead to unauthorized modification of files in locations writable by the Backstage backend process. The vulnerability is tracked as CVE-2026-106560 and has a CVSS 3.1 base score of 7.1, indicating high severity. The issue is fixed in version 0.3.25 of the plugin.

An authenticated user with the ability to execute affected templates can cause generated content to be written outside the intended workspace, potentially modifying files in locations writable by the backend process. This results in an integrity impact with limited availability impact. There is no direct confidentiality impact reported.

A patch is available and should be applied by upgrading '@backstage/plugin-scaffolder-backend-module-confluence-to-markdown' to version 0.3.25 or later. Until the patch is deployed, restrict execution of templates using the affected action to trusted users only, or remove/disable the affected action to prevent exploitation.