Loading...
Skip to main content
GeekWala

CVE-2026-106486 — Vulnerability in...

HIGH

Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions

Published October 7, 2026Updated October 7, 2026Source: osv

Summary

### Impact An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect filesystem paths outside the expected working area. Depending on the backend deployment, this could compromise backend confidentiality, integrity, or availability. ### Patches - `@backstage/plugin-scaffolder-backend-module-bitbucket-cloud` version `0.3.10` - `@backstage/plugin-scaffolder-backend-module-bitbucket-server` version `0.2.25` ### Workarounds - Restrict execution of affected Scaffolder templates to trusted users. - Avoid templates that accept user-controlled target repositories for these actions.

Advisory Timeline

  • First published October 7, 2026 (5 days ago).
  • Last revised October 7, 2026 — 0 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

npm
Update @backstage/plugin-scaffolder-backend-module-bitbucket-cloud to 0.3.10 or later
npm install @backstage/plugin-scaffolder-backend-module-bitbucket-cloud@0.3.10
npm
Update @backstage/plugin-scaffolder-backend-module-bitbucket-server to 0.2.25 or later
npm install @backstage/plugin-scaffolder-backend-module-bitbucket-server@0.2.25

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: npm (2).

PackageEcosystemAffectedFixed In
@backstage/plugin-scaffolder-backend-module-bitbucket-cloud
npm
All versions0.3.10
@backstage/plugin-scaffolder-backend-module-bitbucket-server
npm
All versions0.2.25

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.5 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-106486?
Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.5/10).
How do I check if my project is affected by CVE-2026-106486?
CVE-2026-106486 affects @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and @backstage/plugin-scaffolder-backend-module-bitbucket-server. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-106486 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.5

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-g8rx-f7m5-7794

Related CVEs

More npm advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies