Homepage

@backstage/plugin-scaffolder-backend-module-confluence-to-markdown@0.0.0-nightly-20260814030239

The confluence-to-markdown module for @backstage/plugin-scaffolder-backend

  • latest version

    0.3.26

  • latest non vulnerable version

    0.3.27-next.1

  • first published

    3 years ago

  • latest version published

    28 days ago

  • View plugin-scaffolder-backend-module-confluence-to-markdown package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    External Control of File Name or Path

    @backstage/plugin-scaffolder-backend-module-confluence-to-markdown is a The confluence-to-markdown module for @backstage/plugin-scaffolder-backend

    Affected versions of this package are vulnerable to External Control of File Name or Path via the getAndWriteAttachments function in helpers.ts, where the downloadTitle value derived from a Confluence attachment name is concatenated directly into a filesystem path without sanitization. An attacker who can control attachment names in a Confluence space can supply a path-traversal sequence (e.g. ../../) as the attachment title, causing files to be written to arbitrary locations on the server outside the intended docs/img directory.

    How to fix External Control of File Name or Path?

    Upgrade @backstage/plugin-scaffolder-backend-module-confluence-to-markdown to version 0.3.25 or higher.

    <0.3.25
    • H
    Directory Traversal

    @backstage/plugin-scaffolder-backend-module-confluence-to-markdown is a The confluence-to-markdown module for @backstage/plugin-scaffolder-backend

    Affected versions of this package are vulnerable to Directory Traversal via parsedRepoUrl.filepath in confluenceToMarkdown.ts, where user-controlled repository file path values are concatenated directly into filesystem paths without validation. An authenticated attacker can supply a path containing traversal sequences (e.g. ../) to write files outside the intended workspace directory, potentially overwriting arbitrary files on the server.

    How to fix Directory Traversal?

    Upgrade @backstage/plugin-scaffolder-backend-module-confluence-to-markdown to version 0.3.25 or higher.

    <0.3.25
    Go back to all versions of this package