CVE-2026-106486: Backstage Path Traversal Vulnerability

CVE-2026-106486 Overview

CVE-2026-106486 is a path traversal vulnerability [CWE-22] in Backstage, the open framework for building developer portals. The flaw affects the Bitbucket pull-request scaffolder actions in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud prior to 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server prior to 0.2.25. The actions did not sufficiently validate filesystem paths when copying workspace files during pull-request creation. An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository can write or read files outside the expected working directory on the Backstage backend.

Critical Impact
Successful exploitation can compromise backend confidentiality, integrity, and availability by letting an attacker reach files outside the scaffolder working area.

Affected Products

@backstage/plugin-scaffolder-backend-module-bitbucket-cloud versions prior to 0.3.10
@backstage/plugin-scaffolder-backend-module-bitbucket-server versions prior to 0.2.25
Backstage releases prior to v1.54.6

Discovery Timeline

2026-10-06 - CVE-2026-106486 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-106486

Vulnerability Analysis

The vulnerability resides in the Bitbucket pull-request scaffolder actions that stage repository contents into a temporary working directory before pushing a branch. The copy step relied on fs.cpSync with recursive: true and a filter that excluded only .git content. It did not canonicalize destination paths or confirm that resolved paths stayed within the intended temporary directory. An attacker who can trigger a scaffolder template referencing an allowed Bitbucket repository can craft repository contents, such as symbolic links or carefully constructed paths, that cause the copy routine to traverse out of the scaffolder workspace. The impact scope extends beyond the scaffolder itself, matching the scope-changed classification in the CVSS vector.

Root Cause

The root cause is insufficient path validation during the workspace copy step in bitbucketCloudPullRequest.ts and bitbucketServerPullRequest.ts. The code used Node.js fs.cpSync recursively without resolving symlinks or verifying that each destination path remained a child of the temporary directory.

Attack Vector

Exploitation requires an authenticated Backstage user with permission to execute a template that invokes the vulnerable Bitbucket publish action, and influence over the referenced Bitbucket repository. The attacker places malicious entries in the repository that, when copied by the scaffolder backend, resolve to paths outside the designated workspace. This can be used to overwrite backend files, exfiltrate sensitive data readable by the Backstage process, or disrupt service availability.

typescript

// Security patch from Backstage commit 818528e
// plugins/scaffolder-backend-module-bitbucket-cloud/src/actions/bitbucketCloudPullRequest.ts
// plugins/scaffolder-backend-module-bitbucket-server/src/actions/bitbucketServerPullRequest.ts

        });

        // copy files
-        fs.cpSync(sourceDir, tempDir, {
-          recursive: true,
+        fs.copySync(sourceDir, tempDir, {
          filter: isNotGitDirectoryOrContents,
        });

Source: Backstage commit 818528e. The fix replaces the native fs.cpSync recursive copy with fs.copySync from fs-extra, which applies safer handling of workspace copies during pull-request creation.

Detection Methods for CVE-2026-106486

Indicators of Compromise

Unexpected file writes or modifications on the Backstage backend host outside the scaffolder temporary workspace directories.
Scaffolder task logs referencing Bitbucket pull-request actions that reference unusual source repositories or template inputs.
New symbolic links or files in the Backstage working tree whose paths resolve above the task temp directory.

Detection Strategies

Audit Backstage scaffolder task history for executions of publish:bitbucketCloud:pull-request and publish:bitbucket-server:pull-request actions, correlating with the user identity and target repository.
Monitor the Backstage backend process for file system access outside its documented working directories using host-based telemetry.
Review Bitbucket repositories allowed as scaffolder sources for symlinks or unusual directory structures prior to template execution.

Monitoring Recommendations

Enable detailed scaffolder audit logging and forward it to a central log platform for retention and correlation.
Alert on file writes by the Backstage service account to paths outside the configured workspace or temp directories.
Track installed versions of @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and @backstage/plugin-scaffolder-backend-module-bitbucket-server across environments.

How to Mitigate CVE-2026-106486

Immediate Actions Required

Upgrade @backstage/plugin-scaffolder-backend-module-bitbucket-cloud to 0.3.10 or later and @backstage/plugin-scaffolder-backend-module-bitbucket-server to 0.2.25 or later.
Upgrade the Backstage distribution to release v1.54.6 or later, which bundles the fixed plugin versions.
Restrict scaffolder template execution to trusted users and limit the set of allowed Bitbucket source repositories.

Patch Information

The fix is delivered in Backstage release v1.54.6 and documented in GitHub Security Advisory GHSA-g8rx-f7m5-7794. The code change is in commit 818528e, which replaces the unsafe recursive copy in both Bitbucket pull-request actions.

Workarounds

Disable the vulnerable Bitbucket pull-request scaffolder actions until upgrade is complete.
Tighten scaffolder permissions so only vetted users can run templates that invoke Bitbucket publish actions.
Constrain allowed source repositories in scaffolder configuration to a known-good list controlled by trusted maintainers.

bash

# Upgrade the affected plugin packages to patched versions
yarn workspace backend add \
  @backstage/plugin-scaffolder-backend-module-bitbucket-cloud@^0.3.10 \
  @backstage/plugin-scaffolder-backend-module-bitbucket-server@^0.2.25

# Verify installed versions
yarn why @backstage/plugin-scaffolder-backend-module-bitbucket-cloud
yarn why @backstage/plugin-scaffolder-backend-module-bitbucket-server