Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions

{
  "id": "87b284af567022abfca9d5867639d011f84723bcd83c65f0ec5b4770e8557890",
  "url": "https://osv.dev/vulnerability/GHSA-g8rx-f7m5-7794",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions",
    "summary": "### Impact An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect filesystem paths outside the expected working area. Depending on the backend deployment, this could compromise backend confidentiality, integrity, or availability. ### Patches - `@backstage/plugin-scaffolder-backend-module-bitbucket-cloud` version `0.3.10` - `@backstage/plugin-scaffolder-backend-module-bitbucket-server` version `0.2.25` ### Workarounds - Restrict execution of affected Scaffolder templates to trusted users. - Avoid templates that accept user-controlled target repositories for these actions.",
    "evidence": "osv:GHSA-g8rx-f7m5-7794",
    "products": [
      {
        "name": {
          "value": "@backstage/plugin-scaffolder-backend-module-bitbucket-cloud",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.3.10",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "@backstage/plugin-scaffolder-backend-module-bitbucket-server",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.2.25",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "GHSA-g8rx-f7m5-7794",
      "aliases": [
        "CVE-2026-106486",
        "GHSA-g8rx-f7m5-7794"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.3.10"
                }
              ]
            }
          ],
          "package": {
            "name": "@backstage/plugin-scaffolder-backend-module-bitbucket-cloud",
            "purl": "pkg:npm/%40backstage/plugin-scaffolder-backend-module-bitbucket-cloud",
            "ecosystem": "npm"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-g8rx-f7m5-7794/GHSA-g8rx-f7m5-7794.json"
          }
        },
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.2.25"
                }
              ]
            }
          ],
          "package": {
            "name": "@backstage/plugin-scaffolder-backend-module-bitbucket-server",
            "purl": "pkg:npm/%40backstage/plugin-scaffolder-backend-module-bitbucket-server",
            "ecosystem": "npm"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-g8rx-f7m5-7794/GHSA-g8rx-f7m5-7794.json"
          }
        }
      ],
      "modified": "2026-10-07T18:15:12.173151295Z",
      "provider": "osv",
      "references": [
        "https://github.com/backstage/backstage/security/advisories/GHSA-g8rx-f7m5-7794",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-106486",
        "https://github.com/backstage/backstage/commit/818528e112c36167d76187e9e63fb518399c4dd2",
        "https://github.com/backstage/backstage",
        "https://github.com/backstage/backstage/releases/tag/v1.54.6"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-22",
          "CWE-59"
        ],
        "severity": "HIGH",
        "github_reviewed": true,
        "nvd_published_at": "2026-10-06T21:17:17Z",
        "github_reviewed_at": "2026-10-07T18:01:26Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-106486",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 97163,
  "published_at": "2026-10-07T18:01:26+00:00"
}