CVE-2026-106486: Backstage Bitbucket Scaffolder Path Traversal

CVE-2026-106486 is a path-traversal and link-following vulnerability in Backstage's Scaffolder plugin for Bitbucket pull requests, where an authenticated user who can run an eligible software template and point it at an allowed Bitbucket repository can get the Scaffolder's pull-request actions to write to filesystem paths outside the directory the action is supposed to be confined to, potentially compromising the Backstage backend itself.

CVE-2026-106486 (CWE-22 Path Traversal, CWE-59 Improper Link Resolution Before File Access) affects Backstage, the open-source framework for building internal developer portals used widely for service catalogs and software templating. NVD's description states: "Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate filesystem paths. An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect paths outside the expected working area, potentially compromising backend confidentiality, integrity, or availability" (NVD). Scaffolder templates are Backstage's mechanism for generating new services and opening pull requests against source-control systems on a developer's behalf, so an action that writes files as part of that workflow is normally trusted to stay inside a scoped working directory — this bug breaks that containment.

NVD's own analysis assigns a Primary CVSS v3.1 base score of 9.9 (critical), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H — network-reachable, low attack complexity, low privileges required (an authenticated template-executing user), and a changed scope reflecting impact beyond the Scaffolder plugin itself into the shared backend. The CNA's own GitHub Security Advisory submission scores it lower, CVSS v3.1 8.5 (high), vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H — the vendor rates attack complexity as High rather than Low, reflecting that the attacker also needs to already have permission to execute an eligible template and control an allowed Bitbucket repository target (GitHub Advisory Database GHSA-g8rx-f7m5-7794).

The Backstage maintainers' own GitHub Security Advisory, published 2026-10-07, describes the impact as: "An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect filesystem paths outside the expected working area. Depending on the backend deployment, this could compromise backend confidentiality, integrity, or availability." The advisory lists patched releases @backstage/[email protected] and @backstage/[email protected], references a fix commit in the backstage/backstage repository, and recommends as workarounds restricting execution of the affected Scaffolder templates to trusted users and avoiding templates that accept user-controlled target repositories for the Bitbucket pull-request actions (GitHub Advisory Database GHSA-g8rx-f7m5-7794).

As of 2026-10-30, FIRST scores the probability of exploitation at 0.00367 (30.6th percentile) (FIRST EPSS). CVE-2026-106486 is not currently listed in the CISA Known Exploited Vulnerabilities catalog (checked against the live KEV feed, catalog version 2026.10.30, 1766 entries).

Any Backstage deployment using the Bitbucket Cloud or Bitbucket Server Scaffolder plugin should upgrade @backstage/plugin-scaffolder-backend-module-bitbucket-cloud to 0.3.10+ and @backstage/plugin-scaffolder-backend-module-bitbucket-server to 0.2.25+ (bundled together in Backstage 1.54.6); until patched, operators should restrict who can run the affected templates and avoid templates that let users choose the target Bitbucket repository for pull-request actions.

• Backstage's Bitbucket pull-request Scaffolder actions (plugin-scaffolder-backend-module-bitbucket-cloud before 0.3.10, plugin-scaffolder-backend-module-bitbucket-server before 0.2.25) did not sufficiently validate filesystem paths, letting an authenticated user who can run an eligible template and control an allowed Bitbucket repository affect paths outside the expected working area. — NVD
• NVD Primary CVSS v3.1 base score is 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H); the CNA's own GitHub Security Advisory submission scores it 8.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), treating attack complexity as High rather than Low. — GitHub Advisory Database
• GHSA-g8rx-f7m5-7794, published 2026-10-07, confirms the fix in plugin-scaffolder-backend-module-bitbucket-cloud 0.3.10 and plugin-scaffolder-backend-module-bitbucket-server 0.2.25 (bundled in Backstage 1.54.6), links a fix commit, and recommends restricting template execution to trusted users as a workaround. — GitHub Advisory Database
• EPSS score is 0.00367 (30.6th percentile) as of 2026-10-30; not present in the live CISA KEV feed (catalog version 2026.10.30, 1766 entries) checked by exact cveID match. — FIRST EPSS