CVE-2026-106486

HIGH 8.5

Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions

CVSS Score

8.5

EPSS Score

0.0%

EPSS Percentile

0th

Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate filesystem paths. An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect paths outside the expected working area, potentially compromising backend confidentiality, integrity, or availability. This issue is fixed in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server 0.2.25.

CWE	CWE-22 CWE-59
Vendor	backstage
Product	backstage
Published	Oct 6, 2026

Stay Ahead of the Next One

Get instant alerts for backstage backstage

Be the first to know when new high vulnerabilities affecting backstage backstage are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

backstage / backstage

< 1.54.6

@backstage / plugin-scaffolder-backend-module-bitbucket-cloud

< 0.3.10

@backstage / plugin-scaffolder-backend-module-bitbucket-server

< 0.2.25

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/backstage/backstage/security/advisories/GHSA-g8rx-f7m5-7794 github.com: https://github.com/backstage/backstage/commit/818528e112c36167d76187e9e63fb518399c4dd2 github.com: https://github.com/backstage/backstage/releases/tag/v1.54.6