CVE-2026-106486

Name of the Vulnerable Software and Affected Versions @backstage/plugin-scaffolder-backend-module-bitbucket-cloud versions prior to 0.3.10 @backstage/plugin-scaffolder-backend-module-bitbucket-server versions prior to 0.2.25

Description Bitbucket pull-request Scaffolder actions fail to sufficiently validate filesystem paths. An authenticated user capable of executing an eligible template and influencing an allowed Bitbucket repository can access or modify paths outside the intended working directory, which may compromise the confidentiality, integrity, or availability of the backend.

Recommendations Update @backstage/plugin-scaffolder-backend-module-bitbucket-cloud to version 0.3.10 or later. Update @backstage/plugin-scaffolder-backend-module-bitbucket-server to version 0.2.25 or later.