GHSA-g8rx-f7m5-7794
Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions
At a glance
- Published
- Updated
- CVE
- CVE-2026-106486
- CVSS_V3
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Description
### Impact An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect filesystem paths outside the expected working area. Depending on the backend deployment, this could compromise backend confidentiality, integrity, or availability. ### Patches - `@backstage/plugin-scaffolder-backend-module-bitbucket-cloud` version `0.3.10` - `@backstage/plugin-scaffolder-backend-module-bitbucket-server` version `0.2.25` ### Workarounds - Restrict execution of affected Scaffolder templates to trusted users. - Avoid templates that accept user-controlled target repositories for these actions.
Affected packages
| Package | Versions |
|---|---|
| npm · @backstage/plugin-scaffolder-backend-module-bitbucket-cloud | introduced 0, fixed 0.3.10 |
| npm · @backstage/plugin-scaffolder-backend-module-bitbucket-server | introduced 0, fixed 0.2.25 |
References
- https://github.com/backstage/backstage/security/advisories/GHSA-g8rx-f7m5-7794 WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-106486 ADVISORY
- https://github.com/backstage/backstage/commit/818528e112c36167d76187e9e63fb518399c4dd2 WEB
- https://github.com/backstage/backstage PACKAGE
- https://github.com/backstage/backstage/releases/tag/v1.54.6 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |