EUVD-2026-94003
GHSA-g8rx-f7m5-7794
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
AV:N via the Scaffolder API, PR:L because an authenticated template-running user is required, AC:H due to the symlink/allowed-repo preconditions, S:C as writes escape the workspace to the backend host.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate filesystem paths. An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect paths outside the expected working area, potentially compromising backend confidentiality, integrity, or availability. This issue is fixed in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server 0.2.25.
AnalysisAI
Path traversal in the Backstage Scaffolder Bitbucket pull-request publish actions allows an authenticated user who can execute an eligible template and influence an allowlisted Bitbucket repository to write files outside the expected working area, potentially compromising backend confidentiality, integrity, and availability. Affected are @backstage/plugin-scaffolder-backend-module-bitbucket-cloud before 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server before 0.2.25 (shipped with Backstage before the v1.54.6 release). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Backstage user who can (1) execute an eligible Scaffolder template using the Bitbucket pull-request publish actions (publish:bitbucketCloud:pull-request / Bitbucket Server equivalent) and (2) influence the contents of an 'allowed' target Bitbucket repository - specifically planting a symlink in the cloned repo so the workspace-to-temp copy step resolves paths outside the expected working directory. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional priority rather than a mass-exploitation threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade @backstage/plugin-scaffolder-backend-module-bitbucket-cloud to 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server to 0.2.25, or move the Backstage instance to release v1.54.6 or later, which contains the fix commit 818528e112c36167d76187e9e63fb518399c4dd2 that swaps the symlink-following recursive copy for a safe copySync implementation; see advisory GHSA-g8rx-f7m5-7794 and the v1.54.6 release notes for the canonical upgrade path. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Backstage deployments and confirm which of the affected packages are installed - @backstage/plugin-scaffolder-backend-module-bitbucket-cloud below 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server below 0.2.25 - plus any Backstage release older than v1.54.6, and audit the Bitbucket repository allowlist and the set of users and service accounts holding scaffolder template-execution rights; disable the source-branch creation flow for Bitbucket publish actions wherever it is not operationally essential. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Backstage is an open platform for building developer portals. Rated critical severity (CVSS 9.9), this vulnerability is
Authenticated Backstage users can retrieve the internal execution data of other users' Scaffolder tasks - notably the Se
Authenticated users who can register or modify a TechDocs documentation source can achieve code execution inside the Bac
Arbitrary Python code execution in Backstage's @backstage/plugin-techdocs-node (versions < 1.13.11 and = 1.14.0) lets a
Authenticated remote code execution in the @backstage/plugin-techdocs-node package shipped with the Backstage developer
Improper task-state validation in the @backstage/plugin-scaffolder-backend plugin (Backstage versions prior to 3.3.1, 3.
Improper input validation in the @backstage/plugin-scaffolder-backend-module-sentry scaffolder actions (Backstage 0.3.0
@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Rated high severity (C
Improper authentication in the Backstage @backstage/plugin-auth-backend-module-oidc-provider package prior to 0.4.20 let
Server-side request forgery in the Backstage @backstage/plugin-techdocs-node package (0.11.12 through 1.14.6, and 1.15.0
Improper URL validation in the @backstage/plugin-catalog-backend package of Backstage prior to 3.5.1, 3.6.2, 3.7.2, 3.8.
Improper validation of MkDocs Markdown extension configuration in Backstage's TechDocs Node package (@backstage/plugin-t
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today