CVE-2026-106486 · GHSA-g8rx-f7m5-7794
Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions
- Risk score
- 70/100
- CVSS
- 9.9 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 6 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate filesystem paths. An auth…
- Affected
- @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (npm) < 0.3.10; @backstage/plugin-scaffolder-backend-module-bitbucket-server (npm) < 0.2.25
- Fix
- Upgrade @backstage/plugin-scaffolder-backend-module-bitbucket-cloud to 0.3.10; @backstage/plugin-scaffolder-backend-module-bitbucket-server to 0.2.25 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.9 critical
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| @backstage/plugin-scaffolder-backend-module-bitbucket-cloud | npm | < 0.3.10 | 0.3.10 |
| @backstage/plugin-scaffolder-backend-module-bitbucket-server | npm | < 0.2.25 | 0.2.25 |
References
- https://github.com/advisories/GHSA-g8rx-f7m5-7794
- https://github.com/backstage/backstage/security/advisories/GHSA-g8rx-f7m5-7794
- https://nvd.nist.gov/vuln/detail/CVE-2026-106486
- https://github.com/backstage/backstage/commit/818528e112c36167d76187e9e63fb518399c4dd2
- https://github.com/backstage/backstage/releases/tag/v1.54.6
- https://github.com/advisories/GHSA-g8rx-f7m5-7794
Original description
Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate filesystem paths. An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect paths outside the expected working area, potentially compromising backend confidentiality, integrity, or availability. This issue is fixed in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server 0.2.25.
Last activity 6 Oct 2026. Patch Forecast updates every hour.