CVE-2017-18087

CVE-2017-18087 is an argument injection vulnerability affecting Atlassian Bitbucket Server versions 5.1.0-5.1.6, 5.2.0-5.2.4, 5.3.0-5.3.2, and 5.4.0. This flaw in the "download commit" resource allows authenticated remote attackers to write arbitrary files to disk, potentially leading to code execution, exploitation of CVE-2017-1000117 if a vulnerable Git version is present, or internal service discovery. The vulnerability carries a CVSSv3 score of 7.5 (High), indicating a network-based attack with high impact on confidentiality, integrity, and availability, but requiring low privileges and high attack complexity. Its EPSS score is low, suggesting a low probability of exploitation in the wild. Currently, there is no known public exploit code available for this vulnerability, nor is it listed in CISA's KEV catalog. Community discussion and media coverage are minimal, indicating a lack of widespread attention or active exploitation.