Attestkeep
Sprache: Deutsch
Loslegen

Schwachstellen / CVE-2026-106486

kritisch

CVE-2026-106486

plugin-scaffolder-backend-module-bitbucket-cloud: plugin-scaffolder-backend-module-bitbucket-server: Backstage: Unauthorized file manipulation via Bitbucket pull-request Scaffolder actions

Veröffentlicht Geändert CWE 22, 59
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.

Einstufung nach Quelle

NVD9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
GHSA8.6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Red Hat8.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut GHSA (hoch), Red Hat (hoch).

Beschreibung

Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate filesystem paths. An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect paths outside the expected working area, potentially compromising backend confidentiality, integrity, or availability. This issue is fixed in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server 0.2.25.

Betroffene Pakete und behobene Versionen

QuellePaketBehoben in
npm::GitHub Security Advisory npm@backstage/plugin-scaffolder-backend-module-bitbucket-cloud, @backstage/plugin-scaffolder-backend-module-bitbucket-server0.3.10 und 1 weitere
Alle 2 Einträge aus 1 Quelle zeigen
QuellePaketBehoben in
npm::GitHub Security Advisory npm@backstage/plugin-scaffolder-backend-module-bitbucket-cloud0.3.10
npm::GitHub Security Advisory npm@backstage/plugin-scaffolder-backend-module-bitbucket-server0.2.25

Referenzen

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.