CVE-2026-106486

Summary

The flaw allows authenticated users to manipulate filesystem paths in Bitbucket pull-request Scaffolder actions, potentially enabling them to write files outside the expected working area and compromise backend systems. This affects Backstage's developer portal framework.

Exploitability

Exploitation requires an authenticated user who can execute eligible templates and influence a Bitbucket repository, making it moderately difficult but achievable in environments with active development workflows.

Blast radius

If exploited, this vulnerability could lead to unauthorized file system access, data compromise, or service disruption across the entire Backstage backend infrastructure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to @backstage/plugin-scaffolder-backend-module-bitbucket-cloud 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server 0.2.25 immediately.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.