CVE-2026-106560

Executive Summary

CVE-2026-106560 is a path traversal vulnerability (CWE-22) in the Backstage scaffolder backend module @backstage/plugin-scaffolder-backend-module-confluence-to-markdown. An authenticated user who can execute an affected software template and controls the repository file location parameter can cause generated content to be written outside the intended task workspace, into any location writable by the Backstage backend process. The vulnerability affects versions prior to 0.3.25 and carries a CVSS 3.1 base score of 7.1 (High), reflecting high integrity impact and low availability impact via a network-reachable, low-privilege attack vector.

Technical Analysis

Backstage is an open source framework for building developer portals, and its scaffolder subsystem executes software templates that automate repository creation and content generation. The affected component is a backend module that converts Confluence content to Markdown as part of template execution. According to the NVD description, the module performs improper repository path validation: the repository file location supplied to the template is not constrained to the task workspace before generated content is written to disk.

The vulnerability class is path traversal (CWE-22). In this class, a value intended to denote a relative or confined output path is used to construct a filesystem target without canonicalization or containment enforcement. When the attacker-controlled file location contains traversal segments or resolves to an absolute location outside the workspace root, the write operation follows that path. The result stated in the description is that "generated content [is] written outside the task workspace, within locations writable by the Backstage backend process."

Key constraints derivable from the data:

• The attacker must be authenticated and able to execute an affected template (CVSS privileges required: Low).
• The attacker must control the repository file location used by that template.
• The write is bounded by the filesystem permissions of the Backstage backend process — no privilege escalation beyond that process is described.
• No remote code execution, credential disclosure, or confidentiality impact is claimed; the CVSS vector sets Confidentiality to None, Integrity to High, and Availability to Low.
• No public proof-of-concept, exploit code, or Nuclei template exists, and the CVE is not listed in CISA KEV.

The description does not identify specific function names, parameters, routes, or file paths beyond the package name and the phrase "repository file location." Those implementation-level details are therefore not asserted here. The mechanism is understood at the vulnerability-class level: missing containment checks on an attacker-influenced output path during template-driven content generation.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the facts stated in the NVD description.

1. Reconnaissance and target identification. Identify an internet- or intranet-reachable Backstage developer portal running a version prior to 0.3.25 with the Confluence-to-Markdown scaffolder backend module installed and at least one software template that invokes it. The Shodan dorks above can surface exposed Backstage instances; authenticated access to the portal's template catalog confirms module availability.

2. Prerequisite access. The adversary obtains a valid authenticated account with permission to execute the affected template. This is consistent with the CVSS privileges-required value of Low — no administrative role is required.

3. Triggering the flaw. The user executes the affected template and supplies a repository file location value that, instead of resolving inside the task workspace, resolves to a filesystem location writable by the Backstage backend process. The improper repository path validation in the module allows that out-of-workspace target to be honored when the generated Markdown content is written.

4. Payload and execution method. At the vulnerability-class level, the "payload" is a path value containing traversal or absolute-path components rather than file content. The write carries generated content derived from Confluence input; no code execution primitive is described.

5. Post-exploitation impact. Generated content is deposited in locations outside the task workspace within the backend process's writable scope. Because generated content can be attacker-influenced through the template input, this can overwrite or plant files the backend can reach, producing integrity impact. Availability impact is rated Low and confidentiality impact None per the CVSS vector; the primary risk is corruption or unintended modification of files accessible to the backend service.

Impact Assessment

Business impact. Backstage portals typically serve as the internal developer platform entry point for software templates, catalog metadata, and service scaffolding. A path traversal write primitive in a scaffolder backend module undermines the integrity of files produced or consumed by the platform. Where generated content lands in configuration, template, or content directories writable by the backend process, integrity loss can cascade into downstream pipelines that trust those artifacts.

Affected systems. Any Backstage deployment running @backstage/plugin-scaffolder-backend-module-confluence-to-markdown at a version earlier than 0.3.25, with at least one template that exposes repository file location control to a low-privileged authenticated user.

Blast radius. Bounded by (a) the number of authenticated users able to run affected templates and (b) the filesystem permissions of the backend process. The backend process permissions define the ceiling; the module does not provide a path to higher privilege.

CVSS 3.1 subscores (7.1 High). Attack Vector Network (AV:N); Attack Complexity Low (AC:L); Privileges Required Low (PR:L); User Interaction None (UI:N); Scope Unchanged (S:U); Confidentiality None (C:N); Integrity High (I:H); Availability Low (A:L). The high integrity weighting reflects that successful exploitation results in unauthorized file writes, while unchanged scope and no confidentiality impact limit the overall severity to High rather than Critical.

Exploitability posture. EPSS has not yet been scored by FIRST.org and must not be assumed. No public PoC, exploit code, or Nuclei template has been observed, and the CVE is not in CISA KEV.

Detection Guidance

Sigma Rule

title: Backstage Confluence-to-Markdown Scaffolder Path Traversal Attempt
id: 8f2c1a44-7b6e-4d21-9c3a-5e0d9f1b2c77
status: experimental
description: Detects scaffolder task execution parameters containing path traversal sequences targeting the Backstage Confluence-to-Markdown backend module (CVE-2026-106560).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106560
author: valtersit.com
date: 2026-01-01
logsource:
  product: backstage
  service: scaffolder
detection:
  selection_module:
    package|contains: 'plugin-scaffolder-backend-module-confluence-to-markdown'
  selection_traversal:
    file_location|contains:
      - '../'
      - '..\\'
      - '%2e%2e%2f'
      - '%2e%2e/'
      - '....//'
  condition: selection_module and selection_traversal
fields:
  - user
  - template
  - file_location
falsepositives:
  - Legitimate templates that write to explicitly approved parent directories
level: high
tags:
  - attack.t1190
  - cwe.22

YARA Rule

rule CVE_2026_106560_Backstage_Scaffolder_Traversal
{
    meta:
        description = "Detects path traversal artifacts associated with Backstage Confluence-to-Markdown scaffolder module (CVE-2026-106560)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106560"
        date = "2026-01-01"
        severity = "high"

    strings:
        $pkg = "plugin-scaffolder-backend-module-confluence-to-markdown" ascii
        $trav1 = "../" ascii
        $trav2 = "..\\" ascii
        $enc1 = "%2e%2e%2f" ascii nocase
        $ws = "workspace" ascii

    condition:
        $pkg and 1 of ($trav*) or ($pkg and $enc1)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106560 Backstage Scaffolder Confluence-to-Markdown Path Traversal Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/scaffolder"; nocase; http.request_body; content:"confluence-to-markdown"; nocase; http.request_body; content:".."; nocase; http.request_body; content:"/"; nocase; classtype:attempted-admin; reference:cve,2026-106560; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-106560; sid:2026106560; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ process where event.action == "start" and process.name : "node" and process.args : "*plugin-scaffolder-backend-module-confluence-to-markdown*" ]
  [ file where event.action in ("creation", "modification") and file.path : "*../*" and not file.path : "*workspace*" ]

Splunk SPL Query

index=backstage sourcetype=scaffolder:task OR sourcetype=backstage:audit
| eval loc=coalesce(file_location, repository_location, path)
| where match(loc, "(\.\./)|(\.\.\\\\)|(%2e%2e)")
| stats count min(_time) as first_seen max(_time) as last_seen values(template) as templates by user, loc, host
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="backstage,cve-2026-106560,">
  <rule id="106560" level="12">
    <if_sid>100000</if_sid>
    <decoded_as>json</decoded_as>
    <field name="package">plugin-scaffolder-backend-module-confluence-to-markdown</field>
    <regex type="pcre2">(\.\./|\.\.\\|%2e%2e%2f)</regex>
    <description>CVE-2026-106560: Backstage scaffolder path traversal attempt via Confluence-to-Markdown module</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cwe_22,path_traversal,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations.

• Restrict which authenticated users and roles may execute software templates that invoke @backstage/plugin-scaffolder-backend-module-confluence-to-markdown, following least privilege.
• Review template definitions that expose repository file location input to end users; where possible, constrain or remove user-controllable location values and pin them server-side.
• Harden the Backstage backend process filesystem permissions: run it under a dedicated, low-privilege account with write access limited to the designated workspace directory only. This directly reduces the writable surface reachable through the traversal.
• Treat generated content as untrusted until validation completes; monitor template outputs for unexpected file placement.

2) Patch/upgrade steps.

• Upgrade @backstage/plugin-scaffolder-backend-module-confluence-to-markdown to version 0.3.25 or later, which the NVD description identifies as containing the fix.
• Update the corresponding dependency entries and lockfiles, rebuild, and redeploy the Backstage backend. Verify the effective installed version post-deployment.
• Because no vendor advisory, patch source, or OSV package metadata is currently tracked for this CVE (patch confidence 0/4), validate the upgrade against the official package release notes before relying solely on the version number.

3) Long-term hardening.

• Enforce canonical-path containment for all scaffolder-written artifacts: resolve and confirm every generated path remains within the task workspace before writing.
• Adopt filesystem isolation (container or sandbox mount) for the backend process so that even a successful traversal cannot escape the intended root.
• Add CI checks that assert dependency versions for Backstage scaffolder modules meet minimum safe versions, and subscribe to Backstage security advisories.

References

• NVD — CVE-2026-106560: https://nvd.nist.gov/vuln/detail/CVE-2026-106560
• Backstage project: https://backstage.io
• Backstage security policy and advisories: https://github.com/backstage/backstage/security
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• CISA Known Exploited Vulnerabilities catalog (CVE not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence have been observed for this CVE. No public PoC, exploit code, or Nuclei template is available; EPSS has not yet been scored by FIRST.org.