CVE-2026-106560
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper repository path validation in a scaffolder backend module. An authenticated user who can execute an affected template and control its repository file location may cause generated content to be written outside the task workspace, within locations writable by the Backstage backend process.
Risk Assessment
An authenticated attacker could write files outside the intended area, potentially leading to overwriting critical files or injecting malicious content. This may compromise system integrity.
Recommendation
Update @backstage/plugin-scaffolder-backend-module-confluence-to-markdown to version 0.3.25 or later. Restrict the ability to execute templates and control repository file locations to trusted users.
Related vulnerabilities
- CVE-2026-107685Critical
The WebSocket streaming client in agentjido req_llm starts WebSockex without TLS options, so WebSockex defaults to insecure: true and connects with verify: :verify_none, meaning the server certificate is not validated. The option allowlist also drops any caller-supplied cacerts or ssl_options, so an application cannot enable verification. The OpenAI Responses, Realtime, and Codex WebSocket paths send the API key or OAuth access token in the authorization header, which an on-path attacker can read and modify.
- CVE-2026-25784Critical
In the BlueSpice container image (bluespice/wiki), the default value of $mwsgTokenAuthenticatorServiceCIDR in LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the WIKI_SERVICE_TOKEN_AUTH_ALLOWED environment variable was not set. An empty value disables the IP restriction in the token authenticator component, allowing any user with read access to the wiki to obtain a token from the REST API and get a session with sysop privileges as the internal service user.
- CVE-2026-112862Critical
The Participants Database plugin (participants-database) for WordPress by xnau webdesign is vulnerable to deserialization of untrusted data, allowing Object Injection. The issue affects versions up to and including 2.7.8.5.
- CVE-2026-112860Critical
The Participants Database plugin (participants-database) for WordPress by xnau webdesign contains an SQL Injection vulnerability (improper neutralization of special elements in an SQL command) enabling blind SQL injection. The issue affects versions up to and including 2.7.8.5.
- CVE-2025-30054Critical
CGM CLININET is vulnerable to local privilege escalation. The service processing incoming HL7 messages runs with root privileges, but due to incorrect permissions its scripts and configuration files can be modified by the uhcapache user, allowing execution of arbitrary code as root.
- CVE-2025-30050Critical
CGM CLININET is vulnerable to code injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted user-supplied data. An attacker from an adjacent network can supply a crafted query parameter to import an attacker-controlled module, resulting in arbitrary code execution with root privileges.
- CVE-2025-30047Critical
CGM CLININET is vulnerable to remote code execution caused by deserialization of untrusted data. The server exposes an HTTP-based API used by the administrative module that exchanges data using Java object serialization; an attacker on the same local network can send a crafted serialized object whose deserialization allows arbitrary code execution with root privileges.
- CVE-2025-30046Critical
In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those systems. An attacker on an adjacent network able to send data to these HL7 processes can achieve remote code execution with root privileges.
- CVE-2026-63244Critical
An authentication bypass vulnerability in WizLearn Technologies' Learning Management System (LMS) could allow an unauthenticated remote attacker to bypass password authentication and the OAuth authentication flow by sending a specially crafted POST request. This may result in unauthorized access to user accounts and full administrative control of the LMS platform.
- CVE-2026-55981Critical
A firmware verification vulnerability in Creative Sound Blaster Katana allows an attacker to modify a legitimate firmware image and upload the modified firmware to an affected device. The lack of effective integrity verification enables installation of unauthorized software.
Original NVD description (English source)
Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper repository path validation in a scaffolder backend module. An authenticated user who can execute an affected template and control its repository file location may cause generated content to be written outside the task workspace, within locations writable by the Backstage backend process. This issue is fixed in version 0.3.25.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS