CVE-2026-106486
npm · @backstage/plugin-scaffolder-backend-module-bitbucket-cloud
Summary
Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions
Advisory details
Impact
An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect filesystem paths outside the expected working area. Depending on the backend deployment, this could compromise backend confidentiality, integrity, or availability.
Patches
@backstage/plugin-scaffolder-backend-module-bitbucket-cloudversion0.3.10@backstage/plugin-scaffolder-backend-module-bitbucket-serverversion0.2.25
Workarounds
- Restrict execution of affected Scaffolder templates to trusted users.
- Avoid templates that accept user-controlled target repositories for these actions.
References
- https://github.com/advisories/GHSA-g8rx-f7m5-7794
- https://github.com/backstage/backstage/security/advisories/GHSA-g8rx-f7m5-7794
- https://nvd.nist.gov/vuln/detail/CVE-2026-106486
- https://github.com/backstage/backstage/commit/818528e112c36167d76187e9e63fb518399c4dd2
- https://github.com/backstage/backstage/releases/tag/v1.54.6
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-107716
Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry
- MEDIUMCVE-2026-106508
Backstage has potential file exposure through local TechDocs publisher
- MEDIUMCVE-2026-59944
Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path
- HIGHGHSA-5fqc-mrg8-w798
Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence
- HIGHGHSA-cm62-gvxx-vmxx
Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks
- CRITICALCVE-2026-101894
@xhmikosr/decompress: Path traversal via symlink chain