CVE-2026-106486

criticalPriorität · verfolgen · 40EPSS 0.004 · 30. PerzentilUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.37% (30th) EPSS

CVSS 9.9 · critical

Is it mine?

5 products

Prüfe deine Angriffsfläche

Who says so?

2 sources

nvd · osv

EPSS · bewertet 2026-10-27

Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate filesystem paths. An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect paths outside the expected working area, potentially compromising backend confidentiality, integrity, or availability. This issue is fixed in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server 0.2.25.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.9

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 8.5–9.9

v3.19.9criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.1 · Auswirkung 6

v3.18.5highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · security-advisories@github.comAusnutzbarkeit 1.8 · Auswirkung 6

v3.18.5highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · OSV

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-22USCWE-22USCWE-59USCWE-59US

betroffene Produkte (5)

Betroffene Produkte und Versionsbereiche.

linuxfoundation backstage< 1.54.6nvdUScpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*
linuxfoundation backstage/plugin-scaffolder-backend-module-bitbucket-cloud< 0.3.10nvdUScpe:2.3:a:linuxfoundation:backstage\/plugin-scaffolder-backend-module-bitbucket-cloud:*:*:*:*:*:*:*:*
linuxfoundation backstage/plugin-scaffolder-backend-module-bitbucket-server< 0.2.25nvdUScpe:2.3:a:linuxfoundation:backstage\/plugin-scaffolder-backend-module-bitbucket-server:*:*:*:*:*:*:*:*
npm @backstage/plugin-scaffolder-backend-module-bitbucket-cloud< 0.3.10osvUSpkg:npm/%40backstage/plugin-scaffolder-backend-module-bitbucket-cloud
npm @backstage/plugin-scaffolder-backend-module-bitbucket-server< 0.2.25osvUSpkg:npm/%40backstage/plugin-scaffolder-backend-module-bitbucket-server

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

GHSA-g8rx-f7m5-7794Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions2026-10-07ghsa · osvUS
### Impact An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect filesystem paths outside the expected working area. Depending on the backend deployment, this could compromise backend confidentiality, integrity, or availability. ### Patches - `@backstage/plugin-scaffolder-backend-module-bitbucket-cloud` version `0.3.10` - `@backstage/plugin-scaffolder-backend-module-bitbucket-server` version `0.2.25` ### Workarounds - Restrict execution of affected Scaffolder templates to trusted users. - Avoid templates that accept user-controlled target repositories for these actions.

quellen

Welche Quellen diesen Datensatz belegen und wann.

nvd osv NVD CVE.org MITRE

veröffentlicht 2026-10-06geändert 2026-10-23

Referenzen (3) nvd

Externe Belege — Patches, Meldungen, Analysen.

https://github.com/backstage/backstage/commit/818528e112c36167d76187e9e63fb518399c4dd2Patch
https://github.com/backstage/backstage/releases/tag/v1.54.6PatchRelease Notes
https://github.com/backstage/backstage/security/advisories/GHSA-g8rx-f7m5-7794MitigationVendor Advisory

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan