{"id":"CVE-2026-106486","published":"2026-10-06T21:17:17.323","lastModified":"2026-10-07T17:16:49.083","description":"Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate filesystem paths. An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect paths outside the expected working area, potentially compromising backend confidentiality, integrity, or availability. This issue is fixed in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server 0.2.25.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-22","CWE-59"],"vendors":[],"products":[],"references":[{"url":"https://github.com/backstage/backstage/commit/818528e112c36167d76187e9e63fb518399c4dd2","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","tags":[]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-g8rx-f7m5-7794","tags":[]}],"exploitRefs":[{"url":"https://github.com/backstage/backstage/commit/818528e112c36167d76187e9e63fb518399c4dd2","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","tags":[]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-g8rx-f7m5-7794","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows authenticated users to manipulate filesystem paths in Bitbucket pull-request Scaffolder actions, potentially enabling them to write files outside the expected working area and compromise backend systems. This affects Backstage's developer portal framework.","exploitability":"Exploitation requires an authenticated user who can execute eligible templates and influence a Bitbucket repository, making it moderately difficult but achievable in environments with active development workflows.","blast_radius":"If exploited, this vulnerability could lead to unauthorized file system access, data compromise, or service disruption across the entire Backstage backend infrastructure.","remediation":"Upgrade to @backstage/plugin-scaffolder-backend-module-bitbucket-cloud 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server 0.2.25 immediately.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["path-traversal","filesystem","scaffolder"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:54:10.180Z"}}