Read the docs
TI-2017-13295 Aliases CVE-2017-18087GHSA-c5mx-vvj3-c6pv

The download commit resource in Atlassian Bitbucket Server from version 5.1.0 before…

Priority LOW 36Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

The download commit resource in Atlassian Bitbucket Server from version 5.1.0 before version 5.1.7, from version 5.2.0 before version 5.2.5, from version 5.3.0 before version 5.3.3 and from version 5.4.0 before version 5.4.1 allows remote attackers to write files to disk potentially allowing them to gain code execution, exploit CVE-2017-1000117 if a vulnerable version of git is in use, and or determine if an internal service exists via an argument injection vulnerability in the at parameter.

Why it matters now

EPSS 0.01756 78th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtlassianBitbucket Serverfrom 5.1.0 prior to 5.1.7; from 5.2.0 prior to 5.2.5; from 5.3.0 prior to 5.3.3; from 5.4.0 prior to 5.4.1—No fix listedCNA
  • Bitbucket Server VendorAtlassian Affected from 5.1.0 prior to 5.1.7; from 5.2.0 prior to 5.2.5; from 5.3.0 prior to 5.3.3; from 5.4.0 prior to 5.4.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*5.1.0 to before 5.1.7; 5.2.0 to before 5.2.5; 5.3.0 to before 5.3.3; after 5.4.0, before 5.4.1VulnerableAtlassian
  • cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:* Versions 5.1.0 to before 5.1.7; 5.2.0 to before 5.2.5; 5.3.0 to before 5.3.3; after 5.4.0, before 5.4.1 Vulnerable ·Atlassian

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-18087
  2. 2026-10-03 Alias added: GHSA-c5mx-vvj3-c6pv

References

Advisory 1

  • TI-2022-17043 OS command injection in Atlassian Bitbucket Server KEVCVSS 3.1HIGH 8.8
  • TI-2022-21515 Command injection in Atlassian Bitbucket Data Center CVSS 3.1CRITICAL 9.8
  • TI-2022-09598 Improper authentication in Atlassian Bamboo Server CVSS 3.1CRITICAL 9.8
  • TI-2019-11186 OS command injection in Atlassian Bitbucket Server CVSS 3.1CRITICAL 9.8
  • TI-2018-03782 Link following in Atlassian Bitbucket Server CVSS 3.0CRITICAL 9.9
  • TI-2019-02555 Path traversal in Atlassian Bitbucket Data Center CVSS 3.0CRITICAL 9.1
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences