What is GHSA-g8rx-f7m5-7794?

GHSA-g8rx-f7m5-7794 is a security advisory published by GitHub Security Advisories with High severity. Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions

Which CVE IDs does GHSA-g8rx-f7m5-7794 cover?

GHSA-g8rx-f7m5-7794 covers the following CVE IDs: CVE-2026-106486. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-g8rx-f7m5-7794?

GHSA-g8rx-f7m5-7794 has a CVSS v3 base score of 8.5, published by GitHub Security Advisories.

Which products are affected by GHSA-g8rx-f7m5-7794?

GHSA-g8rx-f7m5-7794 affects 2 products, including: npm/@backstage/plugin-scaffolder-backend-module-bitbucket-cloud:\u003c 0.3.10; npm/@backstage/plugin-scaffolder-backend-module-bitbucket-server:\u003c 0.2.25.

GHSA-g8rx-f7m5-7794HighCVSS 8.5

Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions

Vendor

GitHub Security Advisories

Published

October 7, 2026

Last Modified

October 7, 2026

🔗 CVE IDs covered (1)

CVE-2026-106486 →

📋 Description

Impact

An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect filesystem paths outside the expected working area. Depending on the backend deployment, this could compromise backend confidentiality, integrity, or availability.

Patches

@backstage/plugin-scaffolder-backend-module-bitbucket-cloud version 0.3.10
@backstage/plugin-scaffolder-backend-module-bitbucket-server version 0.2.25

Workarounds

Restrict execution of affected Scaffolder templates to trusted users.
Avoid templates that accept user-controlled target repositories for these actions.

🎯 Affected products2

npm/@backstage/plugin-scaffolder-backend-module-bitbucket-cloud:< 0.3.10
npm/@backstage/plugin-scaffolder-backend-module-bitbucket-server:< 0.2.25