CVE-2025-22167
BaseFortify
Publication date: 2025-10-22
Last updated on: 2025-12-05
Assigner: Atlassian
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| atlassian | jira_data_center | From 9.12.0 (inc) to 9.12.28 (exc) |
| atlassian | jira_data_center | From 10.3.0 (inc) to 10.3.12 (exc) |
| atlassian | jira_data_center | From 11.0.0 (inc) to 11.1.0 (exc) |
| atlassian | jira_server | From 9.12.0 (inc) to 9.12.28 (exc) |
| atlassian | jira_server | From 10.3.0 (inc) to 10.3.12 (exc) |
| atlassian | jira_server | From 11.0.0 (inc) to 11.1.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-22167 is a high-severity Path Traversal vulnerability in Jira Software Data Center and Server that allows an attacker to perform arbitrary write operations on the filesystem. This means an attacker can write files to any location writable by the Jira JVM process by exploiting path traversal, potentially modifying or adding files in unintended locations. [1]
How can this vulnerability impact me? :
This vulnerability can allow attackers to modify any filesystem path writable by the Jira JVM process, which could lead to unauthorized changes to system files, insertion of malicious files, or disruption of normal application behavior. This can compromise the integrity and security of the affected system. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately upgrade your Jira Software Data Center and Server instances to the latest fixed versions. Specifically, upgrade to versions greater than or equal to 9.12.28 for the 9.12.x line, 10.3.12 for the 10.3.x line, or 11.1.0 for the 11.0.x line. If upgrading to the latest version is not possible, ensure you upgrade at least to these specified fixed versions to protect your system from the Path Traversal vulnerability. [1]