Plugin-Scaffolder-Backend-Module-Bitbucket-Server (< 0.2.25)

Authenticated users can exploit improper filesystem validation in Backstage Bitbucket scaffolder plugins to achieve unauthorized file access, modification, or deletion outside the intended working directory via CVE-2026-106486.