CVE-2017-14591: Atlassian Crucible

Critical severity, CVSS 9.0. EPSS: 2.3% chance of exploitation in the next 30 days.

Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, allowing attackers to execute arbitrary code on a system running the impacted software.

Affected products

• Atlassian Crucible: before 4.4.3 (fixed in 4.4.3); version 4.5.0 only
• Atlassian Fisheye: before 4.4.3 (fixed in 4.4.3); version 4.5.0 only

Published 2017-11-29. Last modified 2026-06-17.