CVE-2026-106486

Executive Summary

CVE-2026-106486 is a path traversal vulnerability (CWE-22) in the Backstage Bitbucket Scaffolder backend modules, affecting @backstage/plugin-scaffolder-backend-module-bitbucket-cloud prior to 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server prior to 0.2.25. An authenticated user capable of executing an eligible Scaffolder template and influencing an allowed Bitbucket repository can cause the Bitbucket pull-request actions to operate on filesystem paths outside the intended working area, potentially compromising backend confidentiality, integrity, and availability. The vulnerability carries a CVSS v3.1 base score of 8.5, reflecting high impact across all three CIA dimensions with a changed scope (S:C), and no public proof-of-concept or exploit code is currently known.

Technical Analysis

Backstage is an open framework for building developer portals, and the scaffolder-backend plugin family implements software templates that scaffold new projects and repositories. The affected modules extend Scaffolder functionality with Bitbucket Cloud and Bitbucket Server integrations, specifically exposing pull-request actions that interact with remote Bitbucket repositories.

The core defect is insufficient validation of filesystem paths — classified as CWE-22, Path Traversal. The Bitbucket pull-request Scaffolder actions did not adequately sanitize or constrain paths derived during template execution. Because the actions operate against a working area on the Backstage backend host, crafted input influencing an allowed Bitbucket repository could cause the action to read, write, or otherwise affect paths outside the expected working directory. The NVD description explicitly states that an attacker "could affect paths outside the expected working area," which encompasses unauthorized file reads (confidentiality), modification of files (integrity), and potentially deletion or destabilization of backend files (availability).

The attack surface is the Scaffolder template execution flow exposed through the Backstage backend. Two preconditions are required per the description: (1) the user must be authenticated and able to execute an eligible template, and (2) the user must be able to influence an allowed Bitbucket repository. The phrase "influence an allowed Bitbucket repository" suggests that content the attacker can control in a connected repository can be used to supply malicious path values that the action processes without sufficient validation. This is consistent with a trust-boundary failure: repository content, which is inherently untrusted from the backend's perspective, is consumed as path input without adequate normalization.

The CVSS vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H provides the authoritative risk profile: network exploitable (AV:N), with high attack complexity (AC:H), requiring low privileges (PR:L, i.e., an authenticated low-privileged user), no user interaction (UI:N), with changed scope (S:C) — meaning impact can extend to components beyond the vulnerable module itself — and high confidentiality, integrity, and availability impact (C:H/I:H/A:H). The high attack complexity and low-privilege requirement reflect the precondition that the attacker needs both template execution rights and repository influence, rather than a trivial unauthenticated trigger.

No further code-level detail (specific function names, parameter names, or path-handling routines) is disclosed in the available NVD description, and none should be inferred. The vulnerability class is path traversal in the Bitbucket pull-request Scaffolder actions.

Exploitation Scenarios

No public proof-of-concept is available; the attack chain below is inferred strictly from the vulnerability class (CWE-22) and the stated preconditions in the NVD description. No specific function names, endpoints, or parameters are asserted because none are provided.

1) Reconnaissance / target identification. The attacker identifies a Backstage deployment that has the Bitbucket Cloud or Bitbucket Server Scaffolder modules installed in a vulnerable version range (< 0.3.10 or < 0.2.25 respectively). Because Backstage typically serves as an internal developer portal, the attacker generally needs a valid account with permission to view and execute Scaffolder templates. Shodan dorks such as http.title:"Backstage" and http.html:"scaffolder" can help locate internet-exposed instances, though many deployments are internal-only. The attacker enumerates available templates to find one that is "eligible" (permitted for their account) and that invokes a Bitbucket pull-request action tied to a repository they can influence.

2) Triggering the flaw class. The attacker requires influence over an allowed Bitbucket repository — for example, the ability to control repository content or metadata that the pull-request action consumes during execution. The path traversal is triggered when that influenced input is used, without sufficient validation, as a filesystem path within the Bitbucket pull-request action's working area. Because the path is insufficiently validated against the expected working directory, path components designed to escape that directory can cause the action to target locations outside the intended scope.

3) Payload / execution at the vulnerability-class level. Consistent with path traversal, the attacker supplies input containing directory-traversal sequences or otherwise unconstrained path values via the influenced repository so that the resolved path escapes the intended working area. The exact injection point is not disclosed in the description; the exploitation method is therefore described at the vulnerability-class level only. The action executes with the privileges of the Backstage backend process.

4) Post-exploitation impact. Successful traversal allows the attacker to "affect paths outside the expected working area," potentially leading to disclosure of backend files (confidentiality), modification of unintended files (integrity), and disruption or removal of files affecting backend operation (availability). The changed-scope rating (S:C) indicates the impact may extend beyond the vulnerable module to other components on the host or in the portal.

Impact Assessment

CVSS v3.1 base score: 8.5 (High), vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.

• Confidentiality (C:H): Traversal can expose files outside the working area, potentially leaking source code, template contents, configuration, secrets, or other sensitive backend data.
• Integrity (I:H): Writing to or modifying files outside the intended working area can corrupt application state, templates, or configuration.
• Availability (A:H): Deleting or overwriting critical files can degrade or disable the Backstage backend and dependent Scaffolder functionality.
• Scope (S:C): Impact may extend beyond the vulnerable module, affecting the host or other components.
• Privileges (PR:L): Requires an authenticated low-privileged user who can execute an eligible template.
• Attack complexity (AC:H): Elevated because the attacker must also influence an allowed Bitbucket repository, adding conditions to a successful exploit.
• User interaction (UI:N): No victim interaction is required.

Blast radius centers on the Backstage backend host and any workloads sharing its filesystem or credentials. Because Backstage portals frequently hold integration tokens for source control and CI/CD systems, a confidentiality or integrity breach on the backend can have downstream effects on connected repositories and pipelines. Organizations running the Bitbucket Cloud or Bitbucket Server Scaffolder modules in the affected version ranges should treat this as a high-priority internal threat.

Detection Guidance

The following rules are heuristic and target the path-traversal vulnerability class in a Backstage/Bitbucket Scaffolder context. Because no specific endpoints or parameters are disclosed, detections focus on anomalous traversal patterns in Scaffolder activity and backend file access rather than exact signatures. Tune to your environment.

Sigma Rule

title: Potential Path Traversal in Backstage Bitbucket Scaffolder Actions (CVE-2026-106486)
id: 6a4f9c2e-3b1d-4e77-9a10-cve2026106486
status: experimental
description: Detects directory traversal sequences in Backstage scaffolder template execution or Bitbucket pull-request action inputs, consistent with CVE-2026-106486.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106486
author: valtersit.com
date: 2026/01/01
logsource:
  product: backstage
  service: scaffolder
detection:
  selection_input:
    - action|contains: 'bitbucket'
    - message|contains: 'scaffolder'
  selection_traversal:
    - message|contains:
        - '../'
        - '..\\'
        - '%2e%2e%2f'
        - '....//'
        - '%252e%252e%252f'
  condition: selection_input and selection_traversal
fields:
  - user
  - template
  - action
  - message
falsepositives:
  - Legitimate templates referencing relative parent directories within the working area
level: high
tags:
  - attack.t1190
  - cve.2026.106486

YARA Rule

rule CVE_2026_106486_Backstage_Bitbucket_PathTraversal
{
    meta:
        description = "Detects path traversal sequences associated with CVE-2026-106486 in Backstage Bitbucket scaffolder module inputs/logs"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106486"
        date = "2026-01-01"
        severity = "high"

    strings:
        $bb1 = "plugin-scaffolder-backend-module-bitbucket-cloud" ascii nocase
        $bb2 = "plugin-scaffolder-backend-module-bitbucket-server" ascii nocase
        $trav1 = "../" ascii
        $trav2 = "..\\" ascii
        $trav3 = "%2e%2e%2f" ascii nocase
        $trav4 = "....//" ascii
        $trav5 = "%252e%252e%252f" ascii nocase

    condition:
        (any of ($bb*)) and (2 of ($trav*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106486 Backstage Bitbucket Scaffolder Path Traversal Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"scaffolder"; nocase; http.request_body; content:"bitbucket"; nocase; http.request_body; pcre:"/(\.\.\/|\.\.\\|%2e%2e%2f|%252e%252e%252f|\.\.\.\.\/\/)/i"; classtype:attempted-admin; reference:cve,2026-106486; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-106486; sid:2026106486; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ any where event.category == "web" and
      process.name : "*backstage*" and
      url.path : "*scaffolder*" ]
  [ any where event.category == "process" and
      process.parent.name : "*node*" and
      (process.args : "*../*" or process.args : "*%2e%2e%2f*" or process.args : "*..\\*") ]

Splunk SPL Query

index=backstage OR index=web sourcetype IN (backstage:scaffolder, access_combined, nodejs)
| search (
    (url="*scaffolder*" OR message="*scaffolder*" OR action="*bitbucket*")
    AND (message="*../*" OR message="*..\\*" OR url="*%2e%2e%2f*" OR url="*%252e%252e%252f*" OR params="*..%2f*")
  )
| stats count min(_time) as first_seen max(_time) as last_seen values(url) as urls values(user) as users by src_ip, host
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="backstage,web,cve_2026_106486,">
  <rule id="2026106" level="12">
    <decoded_as>json</decoded_as>
    <field name="service">\.+scaffolder.*</field>
    <field name="action">\.*bitbucket.*</field>
    <match>\.\./|\.\.\\|%2e%2e%2f|%252e%252e%252f</match>
    <description>CVE-2026-106486: Potential path traversal attempt in Backstage Bitbucket scaffolder action</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,cve_2026_106486,</group>
  </rule>

  <rule id="2026107" level="10">
    <if_sid>2026106</if_sid>
    <field name="service">\.*bitbucket.*</field>
    <description>CVE-2026-106486: Suspicious Bitbucket scaffolder invocation following traversal input</description>
    <group>attack,cve_2026_106486,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in specific module versions, but no vendor patch artifacts were confirmed through tracked sources for this report. Treat as unpatched until the version updates below are verified in your environment.

1) Immediate mitigations

• Restrict who can execute Scaffolder templates and limit template eligibility to trusted, vetted users; this directly removes the PR:L precondition.
• Reduce attacker ability to "influence an allowed Bitbucket repository" by tightening Bitbucket integration scopes and repository allowlists to trusted repositories only.
• Where feasible, disable or quarantine Bitbucket pull-request Scaffolder actions until modules are upgraded.
• Run the Backstage backend with least privilege and in a confined filesystem/container boundary so traversal cannot reach sensitive host paths.
• Monitor for high-volume or anomalous backend file access and for traversal sequences in Scaffolder inputs (see Detection Guidance).

2) Patch / upgrade steps

• Upgrade @backstage/plugin-scaffolder-backend-module-bitbucket-cloud to 0.3.10 or later.
• Upgrade @backstage/plugin-scaffolder-backend-module-bitbucket-server to 0.2.25 or later.
• Rebuild and redeploy the Backstage backend after updating dependencies; verify lockfile resolution confirms the patched versions.
• Audit Scaffolder template runs performed before patching for evidence of anomalous path access.

3) Long-term hardening

• Enforce strict path canonicalization and allowlisting within the expected working area for all file operations in Scaffolder actions.
• Apply the principle of least privilege to backend service accounts and Bitbucket integration tokens.
• Adopt software-composition analysis to track Backstage plugin versions and surface vulnerable ranges proactively.
• Segment the Backstage backend from sensitive data stores and CI/CD credentials to limit blast radius from any future path-traversal defect.

References

• NVD — CVE-2026-106486: https://nvd.nist.gov/vuln/detail/CVE-2026-106486
• Backstage project (open framework for developer portals): https://backstage.io
• Backstage Scaffolder backend documentation (Bitbucket modules): https://backstage.io/docs/features/software-templates/
• MITRE CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

No CISA KEV entry, no public proof-of-concept, and no known exploit-in-the-wild or threat actor campaign activity were identified for CVE-2026-106486 at the time of writing.