Backstage EUVD-2026-94373

Exploitation requires that the target Backstage deployment has installed and enabled the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown module (version prior to 0.3.25) and exposes a scaffolder template using its confluence:transform:markdown action. The attacker must be an authenticated Backstage user (PR:L) with permission to execute that template and must control the repository file location/repoUrl input so it includes directory-traversal sequences. Limiting factors: this is an optional, non-default module; authentication and template-execution authorization are required; impact is bounded to filesystem locations writable by the backend process (no confidentiality disclosure). There is no user-interaction requirement on a victim.

This is a moderate-severity path traversal (CWE-22) in the optional @backstage/plugin-scaffolder-backend-module-confluence-to-markdown module, not in Backstage core. The input CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, 7.1) is internally consistent with the description: an authenticated user (PR:L) who can execute an affected scaffolder template controls the repository file location and can cause content to be written outside the task workspace into locations writable by the backend process (I:H, A:L, no confidentiality impact). No EPSS score, no CISA KEV listing, and no public POC were provided - the only exploitation signal is the vendor security advisory (GHSA-2cmg-v53w-8xfp) and the fix commit, so exploitation status is 'no public exploit identified at time of analysis.' The key mitigating factor is the PR:L requirement plus the need for the target to actually install and expose this specific Confluence-to-Markdown module and let the attacker run its template, which narrows the realistic attacker population to insiders/tenants of a Backstage instance rather than anonymous internet attackers. Net: a legitimate issue worth patching, but a bounded, authentication-gated write-primitive rather than a widespread drive-by threat; absence of EPSS/KEV/POC is consistent with low current real-world exploitation.

An authenticated Backstage user with permission to run a scaffolder template that uses the Confluence-to-Markdown action supplies a repository file location containing path traversal sequences (e.g. a repoUrl path like '.../blob/main/../../outside/mkdocs.yml'). When the action transforms the Confluence content, the generated Markdown/attachment files are written outside the intended task workspace into any directory writable by the Backstage backend process. No public exploit code was identified, but the fix commit's regression tests demonstrate the exact traversal payload.