CVE-2026-106559

Executive Summary

CVE-2026-106559 is a path traversal vulnerability (CWE-22) in the Backstage @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package, affecting versions prior to 0.3.25. The flaw stems from improper input validation in the Confluence-to-Markdown scaffolder module, allowing attacker-influenced Confluence content to manipulate file write operations during template execution. Impact is rated CVSS 6.3 (Medium), with high integrity impact and low availability impact, requiring an authenticated Backstage user to execute a template that processes attacker-controlled Confluence content.

Technical Analysis

Backstage is an open framework for building developer portals, and the scaffolder subsystem lets users execute software templates that perform automated actions — in this case, converting Confluence pages to Markdown files. The vulnerable package @backstage/plugin-scaffolder-backend-module-confluence-to-markdown (versions before 0.3.25) performs insufficient input validation on Confluence content before using it to determine file write targets. Because the module derives output file paths or names from content retrieved from Confluence, an attacker who can influence that content (for example, through a Confluence workspace the Backstage instance reads from) can steer the resulting write operation to an unintended location. This is a classic CWE-22 path traversal: unsanitized path components (e.g., ../ sequences or absolute paths) embedded in the upstream data are not neutralized before the filesystem write is issued. The write is performed in the context of the Backstage backend process, so the integrity of files reachable by that process is at risk. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L confirms: network-exploitable, low attack complexity, requires low privileges, requires user interaction, no scope change, no confidentiality impact, high integrity impact, and low availability impact. NVD provides no function-level, endpoint-level, or parameter-level detail, so the precise code path and the exact traversal sink cannot be confirmed beyond the vulnerability class and the general mechanism described above.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available; the following chain is inferred strictly from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. The attacker identifies a Backstage deployment that exposes the scaffolder and has the Confluence-to-Markdown module installed (versions < 0.3.25). The attacker also needs the ability to place or influence content in a Confluence space that the Backstage module will ingest.

2. Triggering the flaw class. A privileged Backstage user is induced (social engineering or a template workflow they routinely run) to execute a scaffolder template that converts the attacker-influenced Confluence content to Markdown. During template execution, the module processes the crafted content without adequate validation of the path used for the file write.

3. Payload / execution method. At the vulnerability-class level, the attacker embeds traversal or absolute-path components within the Confluence content so that the module's output file is written outside the intended template output directory. This is not code execution; it is a controlled arbitrary-file-write primitive bounded by the permissions of the Backstage backend process.

4. Post-exploitation impact. Depending on what the backend process can overwrite, the attacker may corrupt or replace files used by the developer portal or adjacent tooling, causing integrity loss (CVSS I:H) and potential disruption (CVSS A:L). There is no confidentiality impact (C:N).

Impact Assessment

The vulnerability affects organizations running Backstage with the Confluence-to-Markdown scaffolder module at versions below 0.3.25. Because Backstage is a developer portal, the blast radius centers on the integrity of the portal backend and any files the backend process can write. CVSS 6.3 reflects high integrity impact and low availability impact, with confidentiality unaffected. Exploitation requires low privileges (PR:L) and user interaction (UI:R), and network access (AV:N) with low complexity (AC:L). No CISA KEV listing, no EPSS score is available from FIRST.org, and no known exploit code or campaigns are documented. The practical risk is elevated in environments where untrusted users can influence Confluence content that trusted template execution consumes.

Detection Guidance

Sigma Rule

title: Backstage Confluence-to-Markdown Path Traversal File Write
id: 8c2f1a44-9b7e-4d21-a3f0-5e6c1d9b77aa
status: experimental
description: Detects abnormal file write paths (traversal or absolute paths) during Backstage scaffolder Confluence-to-Markdown template execution, indicative of CVE-2026-106559.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106559
author: Threat Intelligence
date: 2026-01-01
logsource:
  product: linux
  service: auditd
detection:
  selection_proc:
    Image|endswith: '/node'
    CommandLine|contains|all:
      - 'scaffolder'
      - 'confluence'
  selection_path:
    CommandLine|contains:
      - '../'
      - '/etc/'
      - '/root/'
      - '/var/www/'
  condition: selection_proc and selection_path
falsepositives:
  - Legitimate templates referencing absolute paths in documentation
level: medium
tags:
  - attack.t1190
  - cve.2026-106559

YARA Rule

rule CVE_2026_106559_Backstage_Confluence_Traversal
{
    meta:
        description = "Detects path traversal patterns in Backstage Confluence-to-Markdown scaffolder artifacts"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106559"
        cve = "CVE-2026-106559"
        author = "Threat Intelligence"
        date = "2026-01-01"

    strings:
        $pkg = "@backstage/plugin-scaffolder-backend-module-confluence-to-markdown"
        $traversal1 = "../" ascii
        $traversal2 = "..\\" ascii
        $conf = "confluence" ascii nocase
        $md = "to-markdown" ascii nocase

    condition:
        $pkg or (($conf and $md) and any of ($traversal*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106559 Backstage Confluence-to-Markdown Path Traversal Attempt"; flow:established,to_server; http.uri; content:"confluence"; nocase; http.uri; content:"..%2f"; nocase; http.uri; content:"to-markdown"; nocase; reference:cve,2026-106559; classtype:attempted-user; sid:2026106559; rev:1;)

Elastic Detection

process where process.name == "node" and
  process.command_line : "*scaffolder*" and
  process.command_line : "*confluence*" and
  process.command_line : ("*../*" or "*..\\*" or "*/etc/*" or "*/root/*")

Splunk SPL Query

index=endpoint (process_name="node" OR process="node")
| where match(command_line, "(?i)scaffolder") AND match(command_line, "(?i)confluence")
| where match(command_line, "\.\./|\.\.\\|/etc/|/root/|/var/www/")
| table _time host user process_name command_line
| sort - _time

Wazuh OSSEC Rule

<group name="backstage,cve_2026_106559,">
  <rule id="106559" level="10">
    <decoded_as>json</decoded_as>
    <field name="process.name">node</field>
    <match>scaffolder</match>
    <match>confluence</match>
    <regex>\.\./|\.\.\\|/etc/|/root/|/var/www/</regex>
    <description>CVE-2026-106559 - Potential Backstage Confluence-to-Markdown path traversal file write attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_106559,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Disable or remove the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package if it is not operationally required.
   • Restrict who can execute scaffolder templates that ingest Confluence content, and validate that only trusted Confluence sources are read.
   • Run the Backstage backend with least-privilege filesystem permissions to limit the reachable write surface.
   • Monitor and alert on unexpected file writes by the backend process (see detection rules above).

2. Patch/upgrade steps:

   • Upgrade @backstage/plugin-scaffolder-backend-module-confluence-to-markdown to version 0.3.25 or later, per the NVD description.
   • Rebuild and redeploy the Backstage backend, then verify the installed package version.
   • Confirm the module no longer writes outside its intended output directory after upgrade.

3. Long-term hardening:

   • Enforce input validation and canonical path checks for any content-driven file write in scaffolder modules.
   • Adopt defense-in-depth (sandboxed output directories, least privilege, content provenance controls) for templates consuming external content.
   • Track the NVD/vendor advisory for further version guidance since no vendor patch source or workaround is currently documented.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106559
• Backstage project: https://backstage.io
• Backstage scaffolder documentation: https://backstage.io/docs/features/software-templates/
• CWE-22 Path Traversal: https://cwe.mitre.org/data/definitions/22.html
• CISA KEV Catalog (not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence are documented at this time.