In breve
- CVE-2026-106486 è una vulnerabilità CRITICO (CVSS 9.9) che riguarda backstage (linuxfoundation), backstage/plugin-scaffolder-backend-module-bitbucket-cloud (linuxfoundation), backstage/plugin-scaffolder-backend-module-bitbucket-server (linuxfoundation).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.37%, superiore al 30.6% delle vulnerabilità.
- Correzione: aggiornare a 1.54.6, 0.3.10, 0.2.25 o successiva.
Description
Impact
An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect filesystem paths outside the expected working area. Depending on the backend deployment, this could compromise backend confidentiality, integrity, or availability.
Patches
@backstage/plugin-scaffolder-backend-module-bitbucket-cloud version 0.3.10@backstage/plugin-scaffolder-backend-module-bitbucket-server version 0.2.25
Workarounds
- Restrict execution of affected Scaffolder templates to trusted users.
- Avoid templates that accept user-controlled target repositories for these actions.
NVD description
Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate filesystem paths. An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect paths outside the expected working area, potentially compromising backend confidentiality, integrity, or availability. This issue is fixed in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server 0.2.25.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free