---
title: "Security Advisory 2018-04-15"
canonical: "https://support.appfire.com/space/EDITOR/149979306/Security%20Advisory%202018-04-15"
format: markdown
---
> Macro (aura-html)

### Power Editor for Bitbucket - Remote Code Execution via File Upload

| Summary | Power Editor for Bitbucket - Remote Code Execution via File Upload |
| --- | --- |
| Advisory Release Date | 4/15/2018 4 PM PDT (Pacific Time, -7 hours) |
| Product | Power Editor for Bitbucket |
| Affected Power Editor Versions | - 2.7 <= version < 3.2 |
| Fixed Power Editor Versions | - 3.2.1 |

  
**Summary of Vulnerability**

This advisory discloses a **critical severity** security vulnerability which was introduced in version 2.7.0 of Power Editor for Bitbucket.** **All versions of Power Editor for Bitbucket** **before 3.2.1 are affected by this vulnerability. Power Editor for Bitbucket 3.2.1 and greater is not impacted by this vulnerability.  


> ℹ️ **Customers who have upgraded Power Editor for Bitbucket to version 3.2.1 and higher are not affected.**

> ❌ **Customers who have downloaded and installed Power Editor for Bitbucket >= 2.7.0 less than 3.2.1**
> ❌ 
> ❌ **Please upgrade your Bitbucket Server installations immediately to fix this vulnerability.**

###   
**Remote Code Execution via File Upload**  


#### **Severity**

Mohami rates the severity level of this vulnerability as **critical**, according to the scale published in[ Atlassian's severity levels](https://www.atlassian.com/security/security-severity-levels). The scale allows us to rank the severity as critical, high, moderate or low.

This is our assessment and you should evaluate its applicability to your own IT environment.  
  


#### **Description**

An authenticated user of Bitbucket Server could gain remote code execution using the upload feature.  
  
All versions of Power Editor for Bitbucket **before 3.2.1** are affected by this vulnerability. Power Editor for Bitbucket 3.2.1 is not impacted by this vulnerability.

### **Fix**

We have taken the following steps to address this issue:

1. Released Power Editor for Bitbucket** **version 3.2.1 that contains a fix for this issue and can be downloaded from: [https://marketplace.atlassian.com/plugins/com.mohamicorp.stash.plugin.editor-for-stash/versions](https://marketplace.atlassian.com/plugins/com.mohamicorp.stash.plugin.editor-for-stash/versions).

### **What You Need to Do**  


Mohami recommends that you upgrade to the [latest version](https://marketplace.atlassian.com/plugins/com.mohamicorp.stash.plugin.editor-for-stash/versions).   


#### **Mitigation**

If you are running an affected version of** Power Editor for Bitbucket **and **cannot upgrade to an unaffected version **the following mitigation can be performed:

1. Disable Power Editor for Bitbucket on the Manage Add-ons page of Bitbucket server.