CVE-2026-106486

{
  "etk_id": "ETK-2026-809",
  "cve_id": "CVE-2026-106486",
  "display_id": "CVE-2026-106486",
  "ghsa_id": "GHSA-g8rx-f7m5-7794",
  "euvd_id": "EUVD-2026-94003",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Path traversal in Backstage Bitbucket Scaffolder actions",
  "summary": "Affected Backstage Bitbucket Cloud and Server Scaffolder backend modules can allow filesystem access outside the intended workspace. An authenticated user must be able to run an eligible template and influence an allowed Bitbucket repository; successful abuse may affect backend data confidentiality, integrity, or availability.",
  "mitigation": "Upgrade @backstage/plugin-scaffolder-backend-module-bitbucket-cloud to 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server to 0.2.25. Until upgrades are complete, limit affected template execution to trusted users and avoid templates that accept user-controlled target repositories.",
  "vendor": "backstage",
  "product": "backstage",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 0.3.10"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "0.3.10"
      ],
      "package_name": "@backstage/plugin-scaffolder-backend-module-bitbucket-cloud",
      "purl": "pkg:npm/@backstage/plugin-scaffolder-backend-module-bitbucket-cloud"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 0.2.25"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "0.2.25"
      ],
      "package_name": "@backstage/plugin-scaffolder-backend-module-bitbucket-server",
      "purl": "pkg:npm/@backstage/plugin-scaffolder-backend-module-bitbucket-server"
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": 8.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
  "epss_score": 0.0033,
  "epss_percentile": 0.2416,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 20.418903,
  "t0_at": "2026-10-06T20:35:10.380000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-06T20:35:10.380000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-06T20:35:10.380000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106486"
    }
  }
}