Backstage Scaffolder Bitbucket plugins: Path traversal in pull request actions
Summary
The Bitbucket Cloud and Bitbucket Server modules of the Backstage Scaffolder do not sufficiently validate filesystem paths in their pull request actions. An authenticated user who can run an eligible template and influence an allowed Bitbucket repository can reach paths outside the expected working area. Depending on the deployment, this can affect the confidentiality, integrity or availability of the backend. Published scores vary between sources (8.5 to 9.9).
Affected
- @backstage/plugin-scaffolder-backend-module-bitbucket-cloud before 0.3.10
- @backstage/plugin-scaffolder-backend-module-bitbucket-server before 0.2.25
- backstage/backstage before 1.54.6 (listed in the CVE record; verify whether the core package is in use)
Fixed in
- @backstage/plugin-scaffolder-backend-module-bitbucket-cloud 0.3.10
- @backstage/plugin-scaffolder-backend-module-bitbucket-server 0.2.25
- Backstage release v1.54.6 (core, if in scope)
Workaround
- Restrict execution of affected Scaffolder templates to trusted users.
- Avoid templates that accept user-controlled target repositories for these actions.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No evidence of exploitation in the wild found in the research.
- No public proof of concept found. Beyond that, unknown.
Our recommendation
- Check whether the Bitbucket Cloud or Server Scaffolder modules are used, including indirect dependencies in lockfiles (for example with yarn why).
- Upgrade the Cloud module to 0.3.10 or later and the Server module to 0.2.25 or later. Check the core package against v1.54.6.
- Until patched, restrict affected templates to trusted users.
- Review audit logs for unusual template runs and Bitbucket repository activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-g8rx-f7m5-7794 github.com
- Fix commit 818528e (protect pull request workspace copies) github.com
- Backstage release v1.54.6 github.com
- OSV GHSA-g8rx-f7m5-7794 osv.dev
- GitLab advisory: Bitbucket Cloud module advisories.gitlab.com
- GitLab advisory: Bitbucket Server module advisories.gitlab.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:36.
Original description (NVD)
Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate filesystem paths. An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect paths outside the expected working area, potentially compromising backend confidentiality, integrity, or availability. This issue is fixed in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server 0.2.25.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.