Backstage: Improper repository path validation in a Scaffolder backend module
Exact source revision recorded 24 Oct 2026 13:17:17 UTC. It does not establish the source's current position. Latest evidence.
osv · GHSA-2cmg-v53w-8xfp
Published### Impact An authenticated user who can execute an affected template and control its repository file location may cause generated content to be written outside the task workspace, within locations writable by the Backstage backend process. ### Patches Patched in `@backstage/plugin-scaffolder-backend-module-confluence-to-markdown` version `0.3.25` ### Workarounds - Restrict execution of templates using the affected action to trusted users. - Remove or disable the affected action until the patched package is deployed.
- Source published
- 7 Oct 2026 18:02:59 UTC
- Source modified
- 7 Oct 2026 18:15:12 UTC
- Observed here
- 24 Oct 2026 13:17:17 UTC
- Source terms
- GitHub Advisory Database · CC-BY-4.0
Original source record · Cite this exact observation · Complete original publisher JSON
This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.
CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Publisher rating · HIGH