Plugin Scaffolder Backend Module Confluence To Markdown
Monthly
Path traversal in Backstage's optional @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package (versions before 0.3.25) allows an authenticated user who can execute a template using the confluence:transform:markdown action and control the repository file location to write generated content outside the task workspace, potentially overwriting files writable by the Backstage backend process. The vulnerability is rated CVSS 7.1 with high integrity and low availability impact but no confidentiality impact; exploitation requires the module to be installed and enabled, and the attacker must supply directory-traversal sequences in the repoUrl input. The issue is fixed in version 0.3.25 (Backstage release v1.54.6), and no public exploit has been identified at time of analysis.
Path traversal in the Backstage Confluence-to-Markdown scaffolder module can let an authenticated Backstage user who runs a template with attacker-influenced Confluence content cause file writes outside the intended image directory, affecting integrity and potentially availability of the scaffolder workspace. The vulnerable package is @backstage/plugin-scaffolder-backend-module-confluence-to-markdown before 0.3.25; exploitation requires the optional module to be deployed and wired into a template, plus an attacker able to create or modify Confluence attachment metadata. There is no public exploit identified at time of analysis, and the issue is fixed in version 0.3.25 and Backstage release v1.54.6.
Path traversal in Backstage's optional @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package (versions before 0.3.25) allows an authenticated user who can execute a template using the confluence:transform:markdown action and control the repository file location to write generated content outside the task workspace, potentially overwriting files writable by the Backstage backend process. The vulnerability is rated CVSS 7.1 with high integrity and low availability impact but no confidentiality impact; exploitation requires the module to be installed and enabled, and the attacker must supply directory-traversal sequences in the repoUrl input. The issue is fixed in version 0.3.25 (Backstage release v1.54.6), and no public exploit has been identified at time of analysis.
Path traversal in the Backstage Confluence-to-Markdown scaffolder module can let an authenticated Backstage user who runs a template with attacker-influenced Confluence content cause file writes outside the intended image directory, affecting integrity and potentially availability of the scaffolder workspace. The vulnerable package is @backstage/plugin-scaffolder-backend-module-confluence-to-markdown before 0.3.25; exploitation requires the optional module to be deployed and wired into a template, plus an attacker able to create or modify Confluence attachment metadata. There is no public exploit identified at time of analysis, and the issue is fixed in version 0.3.25 and Backstage release v1.54.6.