Vulnerability GHSA-g8rx-f7m5-7794
High Risk
HIGH RISK
CVSS Score: 8.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
3 hours ago
October 07, 2026 at 06:01 PM UTC
Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions
0.0.0-nightly-20240207020916 - 0.3.10-next.0
0.0.0-nightly-20240207020916 - 0.3.10-next.0
Summary
Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions
Details
Impact
An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect filesystem paths outside the expected working area. Depending on the backend deployment, this could compromise backend confidentiality, integrity, or availability.
Patches
@backstage/plugin-scaffolder-backend-module-bitbucket-cloudversion0.3.10@backstage/plugin-scaffolder-backend-module-bitbucket-serverversion0.2.25
Workarounds
- Restrict execution of affected Scaffolder templates to trusted users.
- Avoid templates that accept user-controlled target repositories for these actions.
Impacted packages
Timeline
Published
3 hours ago
October 07, 2026 at 06:01 PM UTC
Fixed (0.2.25)
1 month ago
August 28, 2026 at 08:20 AM UTC
Fixed (0.3.10)
1 month ago
August 28, 2026 at 08:21 AM UTC
Last Modified
3 hours ago
October 07, 2026 at 06:15 PM UTC