GitHub Advisoryadvisory · npm

GHSA-g8rx-f7m5-7794 Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions

HIGH Published 2026-10-07 Modified 2026-10-07 Official page ↗
Aliases
CVE-2026-106486
Ecosystem
npm
Packages
@backstage/plugin-scaffolder-backend-module-bitbucket-cloud, @backstage/plugin-scaffolder-backend-module-bitbucket-server
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-22, CWE-59
Reviewed
2026-10-07

Affected packages

• npm @backstage/plugin-scaffolder-backend-module-bitbucket-cloud: < 0.3.10 → fixed in 0.3.10 • npm @backstage/plugin-scaffolder-backend-module-bitbucket-server: < 0.2.25 → fixed in 0.2.25

Description

Impact An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect filesystem paths outside the expected working area. Depending on the backend deployment, this could compromise backend confidentiality, integrity, or availability. Patches • `@backstage/plugin-scaffolder-backend-module-bitbucket-cloud` version `0.3.10` • `@backstage/plugin-scaffolder-backend-module-bitbucket-server` version `0.2.25` Workarounds • Restrict execution of affected Scaffolder templates to trusted users. • Avoid templates that accept user-controlled target repositories for these actions.

Related

Alias · CVE (1)

  • CVE-2026-106486 Backstage is an open framework for building developer portals. vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-59 Improper Link Resolution Before File Access weakness

References