Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions

심각 9.9CVE-2026-106486 · GHSA-g8rx-f7m5-7794 · Published 06/10/2026 · updated 23/10/2026

요약

CVE-2026-106486은(는) backstage (linuxfoundation), backstage/plugin-scaffolder-backend-module-bitbucket-cloud (linuxfoundation), backstage/plugin-scaffolder-backend-module-bitbucket-server (linuxfoundation)에 영향을 주는 심각 (CVSS 9.9) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.37%, 전체 취약점의 30.6%보다 높음.
조치: 1.54.6, 0.3.10, 0.2.25 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
backstage linuxfoundation	`< 1.54.6`	`1.54.6`
backstage/plugin-scaffolder-backend-module-bitbucket-cloud linuxfoundation	`< 0.3.10`	`0.3.10`
backstage/plugin-scaffolder-backend-module-bitbucket-server linuxfoundation	`< 0.2.25`	`0.2.25`
@backstage/plugin-scaffolder-backend-module-bitbucket-cloud npm	`< 0.3.10`	`0.3.10`
@backstage/plugin-scaffolder-backend-module-bitbucket-server npm	`< 0.2.25`	`0.2.25`

Description

Impact

An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect filesystem paths outside the expected working area. Depending on the backend deployment, this could compromise backend confidentiality, integrity, or availability.

Patches

@backstage/plugin-scaffolder-backend-module-bitbucket-cloud version 0.3.10
@backstage/plugin-scaffolder-backend-module-bitbucket-server version 0.2.25

Workarounds

Restrict execution of affected Scaffolder templates to trusted users.
Avoid templates that accept user-controlled target repositories for these actions.

NVD description

Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate filesystem paths. An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect paths outside the expected working area, potentially compromising backend confidentiality, integrity, or availability. This issue is fixed in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server 0.2.25.

References

backstage/backstage security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-106486 · ADVISORY
backstage/backstage commit 818528e · WEB
backstage/backstage · PACKAGE
backstage/backstage release v1.54.6 · WEB

backstage의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

요약

CVE-2026-106486은(는) backstage (linuxfoundation), backstage/plugin-scaffolder-backend-module-bitbucket-cloud (linuxfoundation), backstage/plugin-scaffolder-backend-module-bitbucket-server (linuxfoundation)에 영향을 주는 심각 (CVSS 9.9) 취약점입니다.

향후 30일 내 악용 확률(EPSS): 0.37%, 전체 취약점의 30.6%보다 높음.

조치: 1.54.6, 0.3.10, 0.2.25 이상으로 업데이트하세요.

Package

Affected versions

Patched versions

backstage

linuxfoundation

< 1.54.6

1.54.6

backstage/plugin-scaffolder-backend-module-bitbucket-cloud

linuxfoundation

< 0.3.10

0.3.10

backstage/plugin-scaffolder-backend-module-bitbucket-server

linuxfoundation

< 0.2.25

0.2.25

@backstage/plugin-scaffolder-backend-module-bitbucket-cloud

npm

< 0.3.10

0.3.10

@backstage/plugin-scaffolder-backend-module-bitbucket-server

npm

< 0.2.25

0.2.25

Description

Impact

Patches

@backstage/plugin-scaffolder-backend-module-bitbucket-cloud version 0.3.10
@backstage/plugin-scaffolder-backend-module-bitbucket-server version 0.2.25

Workarounds

Restrict execution of affected Scaffolder templates to trusted users.
Avoid templates that accept user-controlled target repositories for these actions.

NVD description

backstage의 다른 취약점

모두 보기 →