Lack of data validation - Path Traversal In @backstage/plugin-scaffolder-backend-module-confluence-to-markdown
Description
Backstage: Improper input validation in Confluence to Markdown scaffolder module
Impact
Insufficient input validation in the Confluence to Markdown scaffolder module could allow an attacker to influence file write operations during template execution. Exploitation requires a Backstage user to run a template that processes attacker-influenced Confluence content.
Patches
Patched in @backstage/plugin-scaffolder-backend-module-confluence-to-markdown version 0.3.25
Workarounds
If unable to update immediately:
Restrict Confluence edit access to trusted users.
Review Confluence page content before running scaffolder templates against untrusted pages.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 npm | 0.3.25 |
Aliases
References