Vulnpedia
← Search CVEs

CVE-2026-106486

HIGH 8.5

Published 2026-10-06 · Last modified 2026-10-07

Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate filesystem paths. An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect paths outside the expected working area, potentially compromising backend confidentiality, integrity, or availability. This issue is fixed in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server 0.2.25.

ELEVATED IMPACT

Severe if exploited (CVSS 8.5), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.4%chance of exploitation in 30 days · 30th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

8.5CVSS 3.1 · HIGH

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ⚠Privileges: Requires a low-privilege account
  • ✓User interaction: No user interaction needed
  • ⚠Complexity: Needs a race window or specific setup

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Backstage @Backstage Linuxfoundation

Products Backstage Plugin Scaffolder Backend Module Bitbucket Cloud Plugin Scaffolder Backend Module Bitbucket Server Backstage\/Plugin Scaffolder Backend Module Bitbucket Cloud Backstage\/Plugin Scaffolder Backend Module Bitbucket Server

Weakness (CWE)

  • CWE-22: : Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • CWE-59: : Improper Link Resolution Before File Access ('Link Following')

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • @backstage/plugin-scaffolder-backend-module-bitbucket-cloud npm

    pkg:npm/%40backstage/plugin-scaffolder-backend-module-bitbucket-cloud

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 0.3.10
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-g8rx-f7m5-7794/GHSA-g8rx-f7m5-7794.json"
  }
}
    GitHub Advisory Database · GHSA-g8rx-f7m5-7794 · Updated 2026-10-07T18:15:12.173151295Z
  • @backstage/plugin-scaffolder-backend-module-bitbucket-server npm

    pkg:npm/%40backstage/plugin-scaffolder-backend-module-bitbucket-server

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 0.2.25
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-g8rx-f7m5-7794/GHSA-g8rx-f7m5-7794.json"
  }
}
    GitHub Advisory Database · GHSA-g8rx-f7m5-7794 · Updated 2026-10-07T18:15:12.173151295Z

Vendor product assessments

  • rhdh/rhdh-hub-rhel9 as a component of Red Hat Developer Hub · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/rhdh-hub-rhel9?repository_url=registry.redhat.io/rhdh/rhdh-hub-rhel9

    Red Hat · CVE-2026-106486 · Updated 2026-10-23T17:12:46+00:00

Known Affected Software Configurations

VendorProductVersion range
LinuxfoundationBackstage\/Plugin Scaffolder Backend Module Bitbucket Cloud< 0.3.10
LinuxfoundationBackstage\/Plugin Scaffolder Backend Module Bitbucket Server< 0.2.25
LinuxfoundationBackstage< 1.54.6

All CVSS metrics

  • HIGH 8.5 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
  • HIGH 8.5 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
  • CRITICAL 9.9 v3.1 · NVD Primary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS