All vulnerabilities
CVE-2026-106486GHSA-g8rx-f7m5-7794

Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions

backstage @backstage/plugin-scaffolder-backend-module-bitbucket-cloudnpmApplications & CMS
Open in ThreatlineRecord JSON
CVSS
8.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.33%Chance of exploitation activity in the next 30 days, higher than 24% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.3.10Also 0.2.25GitHub
Published6 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

  • 0.3.10@backstage/plugin-scaffolder-backend-module-bitbucket-cloud, npmGitHubnpm install @backstage/plugin-scaffolder-backend-module-bitbucket-cloud@0.3.10
  • 0.2.25@backstage/plugin-scaffolder-backend-module-bitbucket-server, npmGitHubnpm install @backstage/plugin-scaffolder-backend-module-bitbucket-server@0.2.25

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect filesystem paths outside the expected working area. Depending on the backend deployment, this could compromise backend confidentiality, integrity, or availability.

Patches

  • @backstage/plugin-scaffolder-backend-module-bitbucket-cloud version 0.3.10
  • @backstage/plugin-scaffolder-backend-module-bitbucket-server version 0.2.25

Workarounds

  • Restrict execution of affected Scaffolder templates to trusted users.
  • Avoid templates that accept user-controlled target repositories for these actions.

Text from GitHub Advisory Database

Affected versions 7

  • @backstage/plugin-scaffolder-backend-module-bitbucket-cloud, npm< 0.3.10GitHub
  • @backstage/plugin-scaffolder-backend-module-bitbucket-server, npm< 0.2.25GitHub
  • backstageaffected: < 1.54.6CVE List
  • plugin-scaffolder-backend-module-bitbucket-cloudaffected: < 0.3.10CVE List
  • plugin-scaffolder-backend-module-bitbucket-serveraffected: < 0.2.25CVE List
  • @backstage/plugin-scaffolder-backend-module-bitbucket-cloud, npmfrom first release, fixed in 0.3.10OSV
  • @backstage/plugin-scaffolder-backend-module-bitbucket-server, npmfrom first release, fixed in 0.2.25OSV

References 5