Jira Vulnerability Lets Attackers Alter Files Accessible to the Jira JVM Process

Atlassian has disclosed a critical path traversal vulnerability affecting Jira Software Data Center and Server that could allow authenticated attackers to modify files accessible to the Jira Java Virtual Machine process, tracked as CVE-2025-22167. The flaw enables arbitrary write operations to any location the Jira JVM process has permission to access, risking unauthorised modifications to critical system, configuration, or application data.

The CVSS v3.1 score is 8.7, with affected versions dating back to September 2025, including 9.12.0 through 9.12.27, 10.3.0 through 10.3.11, and 11.0.0 through 11.0.1. The vulnerability was introduced in Jira Software version 9.12.0, and Atlassian has released patches; organisations are advised to upgrade.

Upgrade paths vary by version branch: 9.12 should move to 9.12.28 or later, 10.3 to 10.3.12 or higher, and 11.0 to 11.1.0 or later. according to Atlassian, this path traversal flaw poses significant risks in multi-tenant or shared environments, given its potential impact on system integrity.