Backstage, an open framework for developer portals, allowed an authenticated user who could execute a templated action to influence filesystem paths during the Bitbucket pull‑request scaffolder actions. The lack of proper path validation meant the user could target locations outside the intended working directory, potentially reading or modifying sensitive backend files and thereby compromising confidentiality, integrity or availability of the service. This weakness is classified as a directory traversal flaw susceptible to arbitrary file access.

Vulnerable environments run Backstage plugins before the indicated safe versions: @backstage/plugin-scaffolder-backend-module-bitbucket-cloud prior to 0.3.10, @backstage/plugin-scaffolder-backend-module-bitbucket-server prior to 0.2.25, and the overall backstage:backstage framework when these plugins are in use.

The CVSS score of 8.5 marks this as a high‑severity vulnerability, and while the EPSS score is unavailable, it is reasonable to assume a non‑negligible risk of exploitation, especially where the affected plugins are enabled for authenticated users. The vulnerability is not listed in the CISA KEV catalog, but the lack of sufficient validation presents a clear opportunity for an attacker who can execute eligible templates to access or manipulate files outside the intended scope. The likely attack vector is an authenticated request that triggers the scaffolder action; the condition requires the attacker to control a template and have write or pull‑request permission on at least one Bitbucket repository, as inferred from the description.