Vulnerability record · CVE-2018-5225 · published 22 March 2018

CVE-2018-5225: Atlassian bitbucket link following vulnerability

Atlassian · Bitbucket

In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13.0 through 5.4.7), 5.5.0 before 5.5.8 (the fixed version for 5.5.x), 5.6.0 before 5.6.5 (the fixed version for 5.6.x), 5.7.0 before 5.7.3 (the fixed version for 5.7.x), and 5.8.0 before 5.8.2 (the fixed version for 5.8.x), allows authenticated users to gain remote code execution using the in browser editing feature via editing a symbolic link within a repository.

9.9 CVSS 3.0 Critical EPSS 3.4% · top 11.5% CWE-59 · Link following

9.9CVSS 3.0 base score, v2 6.5

3.4%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Bitbucket Atlassian

References

Link	Tags
http://www.securityfocus.com/bid/103488	Third Party AdvisoryVDB Entry
https://confluence.atlassian.com/x/3WNsO	Vendor Advisory
https://jira.atlassian.com/browse/BSERV-10684	Vendor Advisory
http://www.securityfocus.com/bid/103488	Third Party AdvisoryVDB Entry
https://confluence.atlassian.com/x/3WNsO	Vendor Advisory
https://jira.atlassian.com/browse/BSERV-10684	Vendor Advisory

Track CVE-2018-5225 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2022-36804Atlassian Bitbucket Server and Data Center API command injectionMultiple API endpoints in Atlassian Bitbucket Server and Data Center fail to properly neutralize command and argument input, allowing OS command inje…KEVEPSS 99%analysed25 Aug 2022 9.8CVE-2022-43781Bitbucket Server and Data Center command injection via environment variablesBitbucket Server and Data Center contains a command injection flaw (CWE-77) reachable through environment variables. An attacker who can control thei…EPSS 98%analysed17 Nov 2022 9.8CVE-2022-26136Atlassian bamboo improper authentication vulnerabilityA vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps…EPSS 5.4%20 Jul 2022 9.8CVE-2019-15000Atlassian bitbucket os command injection vulnerabilityThe commit diff rest endpoint in Bitbucket Server and Data Center before 5.16.10 (the fixed version for 5.16.x ), from 6.0.0 before 6.0.10 (the fixed…EPSS 7.8%19 Sep 2019 9.1CVE-2019-3397Atlassian bitbucket path traversal vulnerabilityAtlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 (the fixed version for 5.13.x), from 5.14.0 before 5.14…EPSS 4.4%3 Jun 2019 8.8CVE-2022-26137Atlassian bamboo origin validation error vulnerabilityA vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the a…EPSS 2.3%20 Jul 2022 8.8CVE-2019-15010Atlassian bitbucket command injection vulnerabilityBitbucket Server and Bitbucket Data Center versions starting from version 3.0.0 before version 5.16.11, from version 6.0.0 before 6.0.11, from versio…EPSS 2.6%15 Jan 2020 8.8CVE-2019-15012Atlassian bitbucket improper privilege management vulnerabilityBitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from…EPSS 1.6%15 Jan 2020

Source: NIST National Vulnerability Database (record CVE-2018-5225), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.