---
id: "CVE-2022-36804"
kind: "vulnerability"
aliases: ["CVE-2022-36804"]
title: "Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0\u2026"
severity: "critical"
cvss: 8.8
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Atlassian Bitbucket Server and Data Center", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "atlassian bitbucket", "fixed": ["7.6.17"], "affected": ">= 7.0.0, < 7.6.17", "ecosystem": "vendor"}, {"name": "atlassian bitbucket", "fixed": ["7.17.10"], "affected": ">= 7.7.0, < 7.17.10", "ecosystem": "vendor"}, {"name": "atlassian bitbucket", "fixed": ["7.21.4"], "affected": ">= 7.18.0, < 7.21.4", "ecosystem": "vendor"}, {"name": "atlassian bitbucket", "fixed": ["8.0.3"], "affected": ">= 8.0.0, < 8.0.3", "ecosystem": "vendor"}, {"name": "atlassian bitbucket", "fixed": ["8.1.3"], "affected": ">= 8.1.0, < 8.1.3", "ecosystem": "vendor"}, {"name": "atlassian bitbucket", "fixed": ["8.2.2"], "affected": ">= 8.2.0, < 8.2.2", "ecosystem": "vendor"}, {"name": "atlassian bitbucket", "fixed": [], "affected": "= 8.3.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["atlassian", "bitbucket", "exploited", "self-hosted", "vendor"]
not_affected_if: ["managed-hosting"]
published_at: "2022-08-25T06:15:09+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-36804", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36804", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0…

Multiple Bitbucket Server and Data Center API endpoints have a command injection flaw. An attacker who can read a repository, including any public one, can run code on the server with a crafted HTTP request.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Atlassian Bitbucket Server and Data Center affected ? fixed ?
- vendor:atlassian bitbucket affected >= 7.0.0, < 7.6.17 fixed 7.6.17
- vendor:atlassian bitbucket affected >= 7.7.0, < 7.17.10 fixed 7.17.10
- vendor:atlassian bitbucket affected >= 7.18.0, < 7.21.4 fixed 7.21.4
- vendor:atlassian bitbucket affected >= 8.0.0, < 8.0.3 fixed 8.0.3
- vendor:atlassian bitbucket affected >= 8.1.0, < 8.1.3 fixed 8.1.3
- vendor:atlassian bitbucket affected >= 8.2.0, < 8.2.2 fixed 8.2.2
- vendor:atlassian bitbucket affected = 8.3.0 fixed ?

## Fix

Apply the Atlassian update for CVE-2022-36804 per vendor instructions; the sources do not name the fixed version.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-36804
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-36804

## From the sources

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_