The vulnerability resides in an older version of the Confluence‑to‑Markdown scaffolder backend module of Backstage, where path validation for repository writes is insufficient. When an authenticated user initiates a template that controls the repository file location, the module may write generated content to locations outside the intended task workspace, provided those paths are writable by the Backstage backend process. An attacker could therefore create or modify arbitrary files on the host, potentially leading to code execution or system compromise, and bypassing standard sandbox boundaries.

All installations of Backstage that include the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package prior to version 0.3.25 are affected, as well as Backstage hosts that use the framework before the release of v1.54.6 where the module was updated. This applies to any environment where the plugin is deployed and template execution is enabled for authenticated users.

The CVSS score of 7.1 indicates a moderate risk, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with permissions to execute scaffolder templates that influence repository locations. Once such access is available, the attacker can write outside the workspace without additional privileges, making the impact severe. The absence of an EPSS score means the exploitation probability is not quantified, but the lack of public exploitation evidence suggests the issue is not currently widely exploited.