Jira Software Vulnerability Let Attacker Modify Any Filesystem Path Writable By JVM process

EXECUTIVE SUMMARY:

A high-severity path traversal vulnerability CVE-2025-22167, CVSS 8.7 in Jira Software Data Center and Server allows an authenticated attacker to write arbitrary files to any filesystem path writable by the JVM process. The flaw affects versions 9.12.0 through 11.0.1 and enables low-privilege users to inject malicious requests with traversal sequences (e.g., “../”) to bypass restrictions and target sensitive directories. Remote exploitation is possible without user interaction.