External risk intelligence

Backstage Bitbucket Scaffolder Path Traversal Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-106486

Backstage is a developer portal framework typically deployed as an internal tool within corporate networks to manage infrastructure and software components. While some deployments might be internet-facing to support remote teams, it is not designed as a public-facing service by default. The vulnerability requires authenticated access to trigger the scaffolder actions, placing it in the category of internally managed services.

Path Traversal

Linuxfoundation Backstage\/plugin Scaffolder Backend Module Bitbucket Cloud

before 0.3.10before 0.2.25before 1.54.6

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Backstage's Bitbucket integration could allow authenticated users to affect unintended system paths, potentially impacting backend confidentiality, integrity, or availability. The primary concern is confirming if your environment uses the affected components.

Unvalidated paths in Bitbucket actions.
It impacts developer portal backend systems.
Confirm relevance and check for exposure.

Attack Path

How an attacker could exploit the issue

An authenticated user with the ability to use specific Backstage templates and influence an allowed Bitbucket repository could exploit this vulnerability. By manipulating filesystem paths within the Bitbucket pull request actions, an attacker could potentially read or write files outside of the intended directory, leading to unauthorized access or modification of backend systems.

Authenticated user with template access.
Template action influences Bitbucket paths.
Risk of data compromise and system disruption.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an authenticated user influencing an allowed Bitbucket repository could affect filesystem paths outside the expected working area, potentially impacting backend confidentiality, integrity, or availability.

Backend filesystem paths.
Path manipulation during template execution.
Compromised backend confidentiality, integrity, or availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given the nature of Backstage as a developer portal, the platform or infrastructure teams responsible for its deployment and maintenance are likely to own this issue. The first practical step is to identify all instances of the affected Backstage plugins, confirm their reachability and criticality, and then coordinate remediation with the accountable application or platform owners.

Platform/Infrastructure teams own resolution.
Verify affected plugin instances and exposure.
Plan and coordinate remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Backstage and its Bitbucket modules?

Backstage is an open-source framework from the Linux Foundation used to build internal developer portals. It acts as a central hub for managing software components and infrastructure. The affected Bitbucket modules are specific scaffolder plugins that enable developers to automate repository tasks—such as creating pull requests—directly from within the Backstage portal interface.

What is the vulnerability in CVE-2026-106486?

This is a path traversal vulnerability, classified as CWE-22 and CWE-59. It occurs because the affected plugin fails to properly validate filesystem paths. Essentially, the software does not restrict input, allowing an attacker to 'escape' the intended working directory to read or modify files elsewhere on the backend system, which could compromise the entire server's security.

How can an attacker trigger this flaw?

An attacker needs authorized access to the Backstage instance and the ability to execute specific templates that interact with Bitbucket repositories. This bug cannot be triggered by an unauthenticated user or by simply viewing a public repository. It requires the ability to craft input for a Bitbucket scaffolder action that the system then processes without sufficient path checks.

Do I need to worry if my Backstage instance is internal?

According to Halo Surface Signal, Backstage is typically deployed as an internal tool, which reduces its exposure compared to public-facing services. However, because the vulnerability requires authenticated access, a malicious or compromised insider with portal permissions remains a risk. You should assess how widely template execution is permitted within your organization.

When should I update my Backstage plugins?

You should prioritize updating as soon as you confirm you are running versions of the Bitbucket scaffolder modules below 0.3.10 for Cloud or 0.2.25 for Server. Since this flaw allows unauthorized backend access, coordinate with your infrastructure team to verify your current plugin versions and apply the patches provided in the latest Backstage release.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.