Is CVE-2026-106486 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106486 being exploited in the wild.

How severe is CVE-2026-106486?

High severity, with a CVSS score of 8.5, published 6 October 2026.

Which products and versions are affected?

Backstage Plugin-Scaffolder-Backend-Module-Bitbucket-Cloud before 0.3.10; Backstage Plugin-Scaffolder-Backend-Module-Bitbucket-Server before 0.2.25; @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (npm) < 0.3.10, SEMVER:introduced=0,fixed=0.3.10; @backstage/plugin-scaffolder-backend-module-bitbucket-server (npm) < 0.2.25, SEMVER:introduced=0,fixed=0.2.25.

Is there a fix for CVE-2026-106486?

Yes. @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (npm): upgrade to 0.3.10 or later; @backstage/plugin-scaffolder-backend-module-bitbucket-server (npm): upgrade to 0.2.25 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-106486 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-106486?

Check whether you run Backstage Plugin-Scaffolder-Backend-Module-Bitbucket-Cloud, Backstage Plugin-Scaffolder-Backend-Module-Bitbucket-Server, @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106486: Backstage Scaffolder Bitbucket path traversal in pull request actions

Q: Is there a fix for CVE-2026-106486?

Yes. @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (npm): upgrade to 0.3.10 or later; @backstage/plugin-scaffolder-backend-module-bitbucket-server (npm): upgrade to 0.2.25 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-106486 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-106486?

Check whether you run Backstage Plugin-Scaffolder-Backend-Module-Bitbucket-Cloud, Backstage Plugin-Scaffolder-Backend-Module-Bitbucket-Server, @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106486 · Severity: high · CVSS 8.5 · Published 2026-10-06

Backstage is an open-source developer portal framework. The Bitbucket pull-request scaffolder actions allowed authenticated users to manipulate filesystem paths outside of intended working directories, potentially exposing or modifying sensitive backend files. An attacker with template execution permissions could compromise the backend's confidentiality, integrity, or availability by exploiting insufficient path validation.

Vendors: Backstage, npm.

Quick answers

Is CVE-2026-106486 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106486 being exploited in the wild.
How severe is CVE-2026-106486?: High severity, with a CVSS score of 8.5, published 6 October 2026.
Which products and versions are affected?: Backstage Plugin-Scaffolder-Backend-Module-Bitbucket-Cloud before 0.3.10; Backstage Plugin-Scaffolder-Backend-Module-Bitbucket-Server before 0.2.25; @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (npm) < 0.3.10, SEMVER:introduced=0,fixed=0.3.10; @backstage/plugin-scaffolder-backend-module-bitbucket-server (npm) < 0.2.25, SEMVER:introduced=0,fixed=0.2.25.
Is there a fix for CVE-2026-106486?: Yes. @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (npm): upgrade to 0.3.10 or later; @backstage/plugin-scaffolder-backend-module-bitbucket-server (npm): upgrade to 0.2.25 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106486 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-106486?: Check whether you run Backstage Plugin-Scaffolder-Backend-Module-Bitbucket-Cloud, Backstage Plugin-Scaffolder-Backend-Module-Bitbucket-Server, @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@backstage/plugin-scaffolder-backend-module-bitbucket-cloud (npm): upgrade to 0.3.10 or later
```
npm install @backstage/plugin-scaffolder-backend-module-bitbucket-cloud@0.3.10
```
@backstage/plugin-scaffolder-backend-module-bitbucket-server (npm): upgrade to 0.2.25 or later
```
npm install @backstage/plugin-scaffolder-backend-module-bitbucket-server@0.2.25
```

Technical details

The Bitbucket pull-request Scaffolder actions in the bitbucket-cloud and bitbucket-server modules did not sufficiently validate filesystem paths, allowing path traversal attacks. An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository can affect paths outside the expected working area. The vulnerability requires authentication and template execution privileges but allows arbitrary filesystem access on the backend.

Affected products

Backstage plugin-scaffolder-backend-module-bitbucket-cloud before 0.3.10
Backstage plugin-scaffolder-backend-module-bitbucket-server before 0.2.25

Identifiers

CVE-2026-106486
GHSA-g8rx-f7m5-7794

Timeline

2026-10-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.