Backstage Confluence Module CVE-2026-106559

The Confluence-to-Markdown scaffolder module (@backstage/plugin-scaffolder-backend-module-confluence-to-markdown) must be installed and wired into a scaffolder template. The specific trigger is an attacker-controlled Confluence attachment title (e.g. '../../screenshot.png') that the module's getAndWriteAttachments helper used to concatenate directly into the write path (workspace/mkdocsDir/docs/img/<title>) without safe path resolution. Exploitation is LIMITED by: (1) an authenticated Backstage user (PR:L) must actively execute a template that targets the attacker-influenced Confluence space (UI:R); (2) the attacker must be able to create or modify Confluence content/attachment metadata consumed by that template; and (3) the vulnerable optional module must be deployed. It is not reachable by an unauthenticated remote attacker against a default Backstage install.

The provided CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L, base 6.3 Medium) tells a coherent but constrained story: the attack vector is network-reachable, but exploitation is gated by two significant friction points - PR:L means an authenticated (low-privilege) Backstage user is involved, and UI:R means that user must actively run a scaffolder template. The impact is integrity-focused (I:H, file write), with no confidentiality loss (C:N) and only minor availability impact (A:L), consistent with the CWE-22 path traversal that lets an attacker influence file write locations. No EPSS score is provided in the input, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no public exploit code is referenced - only the vendor fix commit and advisory are present - so there is no public exploit identified at time of analysis. No SSVC decision data is supplied. Netting these signals: this is a real but secondary-priority issue. The network attack vector overstates reach because actual exploitation depends on a trusted internal workflow (a user running a template that ingests attacker-controlled Confluence content) rather than direct remote compromise. It is more of a 'malicious/compromised Confluence content poisons an internal automation step' threat than an internet-facing RCE. Teams running the affected optional module should patch, but this is not an emergency on the level of an unauthenticated, no-interaction flaw.

An attacker who can create or edit Confluence content sets an attachment title to a traversal string such as '../../screenshot.png'. A Backstage user later runs a scaffolder template that uses the confluence-to-markdown module against that Confluence space; the module downloads the attachment and writes it to a path resolved outside the intended docs/img directory, corrupting or planting files elsewhere in the workspace. No public exploit code is referenced, though the vendor patch and a regression test demonstrating the traversal are publicly visible.