CVE-2019-15010

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-01-15 · updated 2026-06-17
Weakness: CWE-77

Description

Bitbucket Server and Bitbucket Data Center versions starting from version 3.0.0 before version 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, and from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via certain user input fields. A remote attacker with user level permissions can exploit this vulnerability to run arbitrary commands on the victim's systems. Using a specially crafted payload as user input, the attacker can execute arbitrary commands on the victim's Bitbucket Server or Bitbucket Data Center instance.

Affected products

Atlassian Bitbucket Server: from 3.0.0 before 5.6.11; from 6.0.0 before 6.0.11; from 6.1.0 before 6.1.9; from 6.2.0 before 6.2.7; from 6.3.0 before 6.3.6; from 6.4.0 before 6.4.4 — fixed in 5.6.11, 6.0.11, 6.1.9, 6.2.7, 6.3.6, 6.4.4

How to fix

Upgrade to a fixed version: Atlassian Bitbucket Server 5.6.11, 6.0.11, 6.1.9, 6.2.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-15010 or the next vulnerability affects your stack