Jira Path Traversal Flaw (CVE-2025-22167) Allows Arbitrary File Write on Server/Data Center

Atlassian has released patches addressing a high-severity Path Traversal vulnerability, CVE-2025-22167, affecting Jira Software Data Center and Server as well as Jira Service Management Data Center and Server. The flaw, rated CVSS 8.7, allows attackers to perform arbitrary file writes on systems running vulnerable Jira versions, potentially leading to data corruption or remote code execution if chained with other exploits.

“This Path Traversal (Arbitrary Write) vulnerability, with a CVSS Score of 8.7, allows an attacker to modify any filesystem path writable by the Jira JVM process,” according to Atlassian’s advisory. The vulnerability was introduced in Jira Software versions 9.12.0 and 10.3.0, persisting through 11.0.0, and for Jira Service Management it was introduced in versions 5.12.0 and 10.3.0.

Atlassian advises immediate upgrades to patched versions: Jira Software Data Center & Server 9.12.28+, 10.3.12+, 11.1.0+ and Jira Service Management Data Center & Server 5.12.29+, 10.3.12+.