CVE-2026-106486

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-106486", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-06T18:46:47.765Z", "datePublished": "2026-10-06T20:35:10.380Z", "dateUpdated": "2026-10-07T16:22:11.503Z"}, "containers": {"cna": {"title": "Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-59", "lang": "en", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/backstage/backstage/security/advisories/GHSA-g8rx-f7m5-7794", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/backstage/backstage/security/advisories/GHSA-g8rx-f7m5-7794"}, {"name": "https://github.com/backstage/backstage/commit/818528e112c36167d76187e9e63fb518399c4dd2", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/commit/818528e112c36167d76187e9e63fb518399c4dd2"}, {"name": "https://github.com/backstage/backstage/releases/tag/v1.54.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"}], "affected": [{"vendor": "backstage", "product": "backstage", "versions": [{"version": "< 1.54.6", "status": "affected"}]}, {"vendor": "@backstage", "product": "plugin-scaffolder-backend-module-bitbucket-cloud", "versions": [{"version": "< 0.3.10", "status": "affected"}]}, {"vendor": "@backstage", "product": "plugin-scaffolder-backend-module-bitbucket-server", "versions": [{"version": "< 0.2.25", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-06T20:35:10.380Z"}, "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate filesystem paths. An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect paths outside the expected working area, potentially compromising backend confidentiality, integrity, or availability. This issue is fixed in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server 0.2.25."}], "source": {"advisory": "GHSA-g8rx-f7m5-7794", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-07T16:21:14.423550Z", "id": "CVE-2026-106486", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T16:22:11.503Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-106486", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-07T16:21:14.423550Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T16:22:06.794Z"}}], "cna": {"title": "Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions", "source": {"advisory": "GHSA-g8rx-f7m5-7794", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "backstage", "product": "backstage", "versions": [{"status": "affected", "version": "< 1.54.6"}]}, {"vendor": "@backstage", "product": "plugin-scaffolder-backend-module-bitbucket-cloud", "versions": [{"status": "affected", "version": "< 0.3.10"}]}, {"vendor": "@backstage", "product": "plugin-scaffolder-backend-module-bitbucket-server", "versions": [{"status": "affected", "version": "< 0.2.25"}]}], "references": [{"url": "https://github.com/backstage/backstage/security/advisories/GHSA-g8rx-f7m5-7794", "name": "https://github.com/backstage/backstage/security/advisories/GHSA-g8rx-f7m5-7794", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/backstage/backstage/commit/818528e112c36167d76187e9e63fb518399c4dd2", "name": "https://github.com/backstage/backstage/commit/818528e112c36167d76187e9e63fb518399c4dd2", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/backstage/backstage/releases/tag/v1.54.6", "name": "https://github.com/backstage/backstage/releases/tag/v1.54.6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate filesystem paths. An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect paths outside the expected working area, potentially compromising backend confidentiality, integrity, or availability. This issue is fixed in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server 0.2.25."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-06T20:35:10.380Z"}}}, "cveMetadata": {"cveId": "CVE-2026-106486", "state": "PUBLISHED", "dateUpdated": "2026-10-07T16:22:11.503Z", "dateReserved": "2026-10-06T18:46:47.765Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-06T20:35:10.380Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "backstage", "vendor": "backstage", "versions": [{"status": "affected", "version": "< 1.54.6"}]}, {"product": "plugin-scaffolder-backend-module-bitbucket-cloud", "vendor": "@backstage", "versions": [{"status": "affected", "version": "< 0.3.10"}]}, {"product": "plugin-scaffolder-backend-module-bitbucket-server", "vendor": "@backstage", "versions": [{"status": "affected", "version": "< 0.2.25"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend-module-bitbucket-cloud:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "51A44535-7A5D-46B0-AC79-5E9DAE726BAE", "versionEndExcluding": "0.3.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend-module-bitbucket-server:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "19CE6595-34DE-4124-B304-FDEFCB3FD00B", "versionEndExcluding": "0.2.25", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*", "matchCriteriaId": "630B6B8B-D515-4FEF-83C7-9CF51C7EB2F5", "versionEndExcluding": "1.54.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate filesystem paths. An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect paths outside the expected working area, potentially compromising backend confidentiality, integrity, or availability. This issue is fixed in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server 0.2.25."}], "id": "CVE-2026-106486", "lastModified": "2026-10-23T15:01:04.000", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-106486", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-07T16:21:14.423550Z", "version": "2.0.3"}}]}, "published": "2026-10-06T21:17:17.323", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/backstage/backstage/commit/818528e112c36167d76187e9e63fb518399c4dd2"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes"], "url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/backstage/backstage/security/advisories/GHSA-g8rx-f7m5-7794"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-59"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "plugin-scaffolder-backend-module-bitbucket-cloud: plugin-scaffolder-backend-module-bitbucket-server: Backstage: Unauthorized file manipulation via Bitbucket pull-request Scaffolder actions", "id": "2547185", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547185"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-22", "details": ["Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate filesystem paths. An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect paths outside the expected working area, potentially compromising backend confidentiality, integrity, or availability. This issue is fixed in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server 0.2.25.", "A flaw was found in the Backstage Bitbucket Scaffolder backend modules. The Bitbucket pull request Scaffolder actions do not properly validate filesystem paths. An authenticated attacker who can execute an eligible template and influence an allowed repository can manipulate files outside the intended working directory. This can lead to unauthorized file modification, data disclosure, or disruption of backend services."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-106486", "package_state": [{"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Affected", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub"}], "public_date": "2026-10-06T20:35:10Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-106486\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106486\nhttps://github.com/backstage/backstage/commit/818528e112c36167d76187e9e63fb518399c4dd2\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\nhttps://github.com/backstage/backstage/security/advisories/GHSA-g8rx-f7m5-7794"], "statement": "Red Hat Product Security rates this vulnerability as Important because an authenticated user capable of triggering software templates can exploit path traversal to manipulate files on the underlying host, potentially escaping the workspace boundary and affecting critical backend services. In Red Hat Developer Hub, the issue specifically affects environments where Bitbucket integration modules are active and accessible to end users. Exploitation requires privileges to launch templates that interface with an authorized Bitbucket repository, meaning installations that restrict template execution or do not integrate with Bitbucket are not exposed.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.54.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "backstage", "source": "cna", "vendor": "backstage"}, "product": "backstage", "vendor": "backstage"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.3.10)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "plugin-scaffolder-backend-module-bitbucket-cloud", "source": "cna", "vendor": "@backstage"}, "product": "plugin-scaffolder-backend-module-bitbucket-cloud", "vendor": "backstage"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.2.25)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "plugin-scaffolder-backend-module-bitbucket-server", "source": "cna", "vendor": "@backstage"}, "product": "plugin-scaffolder-backend-module-bitbucket-server", "vendor": "backstage"}], "created": "2026-10-07T00:15:07.175548+00:00", "updated": "2026-10-09T08:31:34.772290+00:00", "vendors": ["backstage", "backstage$PRODUCT$backstage", "backstage$PRODUCT$plugin-scaffolder-backend-module-bitbucket-cloud", "backstage$PRODUCT$plugin-scaffolder-backend-module-bitbucket-server"]}