CVE-2026-106486: Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions

October 7, 2026

An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect filesystem paths outside the expected working area. Depending on the backend deployment, this could compromise backend confidentiality, integrity, or availability.

References

github.com/advisories/GHSA-g8rx-f7m5-7794
github.com/backstage/backstage/commit/818528e112c36167d76187e9e63fb518399c4dd2
github.com/backstage/backstage/releases/tag/v1.54.6
github.com/backstage/backstage/security/advisories/GHSA-g8rx-f7m5-7794
nvd.nist.gov/vuln/detail/CVE-2026-106486

Code Behaviors & Features

Detect and mitigate CVE-2026-106486 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →