CVE-2026-106486

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description

Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate filesystem paths. An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect paths outside the expected working area, potentially compromising backend confidentiality, integrity, or availability. This issue is fixed in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server 0.2.25.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106486

EUVD

EUVD-2026-94003

Affected Vendors & Products

Vendor	Product	Version / Range
backstage	backstage	< 1.54.6
@backstage	plugin-scaffolder-backend-module-bitbucket-cloud	< 0.3.10
@backstage	plugin-scaffolder-backend-module-bitbucket-server	< 0.2.25

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Backstage framework's Bitbucket pull-request Scaffolder actions. It allows authenticated users who can run templates and influence a Bitbucket repository to access paths outside the intended working area. This could lead to breaches in backend confidentiality, integrity, or availability.

Detection Guidance

Check installed versions of @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and @backstage/plugin-scaffolder-backend-module-bitbucket-server. If versions are below 0.3.10 or 0.2.25 respectively, the system is vulnerable. Review Scaffolder template configurations for Bitbucket actions to ensure proper path validation is implemented.

Impact Analysis

If you use Backstage with Bitbucket integration, an attacker with template execution rights could access or modify files outside the expected workspace. This may result in data leaks, unauthorized changes, or system disruptions affecting your backend operations.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Compliance may be compromised if data confidentiality or integrity is breached.

Mitigation Strategies

Update @backstage/plugin-scaffolder-backend-module-bitbucket-cloud to version 0.3.10 or later and @backstage/plugin-scaffolder-backend-module-bitbucket-server to version 0.2.25 or later to fix the path validation issue.

Hi! I’m here to help you understand CVE-2026-106486. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70