# CVE-2025-22167: This High severity Path Traversal (Arbitrary Write) vulnerability was introduced in versions: 9.12.0, 10.3.0 and…

Source: https://junglewise.ai/threats/cve-2025-22167-this-high-severity-path-traversal-arbitrary-write-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-22  
License: CC BY 4.0 with a link back

CVE-2025-22167 · Severity: medium · CVSS 6.5 · Published 2025-10-22

This High severity Path Traversal (Arbitrary Write) vulnerability was introduced in versions: 9.12.0, 10.3.0 and remain present in 11.0.0 of Jira Software Data Center and Server. This Path Traversal (Arbitrary Write) vulnerability, with a CVSS Score of 8.7, allows an attacker to modify any filesystem path writable by the Jira JVM process. Atlassian recommends that Jira Software Data Center and Server customers upgrade to the latest version; if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
 Jira Software Data Center and Server 9.12: Upgrade to a release greater than or equal to 9.12.28
 Jira Software Data Center and Server 10.3: Upgrade to a release greater than or equal to 10.3.12
 Jira Software Data Center and Server 11.0: Upgrade to a release greater than or equal to 11.1.0

See the release notes. You can download the latest version of Jira Software Data Center and Server from the download center. This vulnerability was reported via our Atlassian (Internal) program.

Technologies: [Atlassian Jira Data Center](https://junglewise.ai/threats/technologies/jira-data-center), [Atlassian Jira Server](https://junglewise.ai/threats/technologies/jira-server). Vendors: [Atlassian](https://junglewise.ai/threats/vendors/atlassian).

## Quick answers

**Is CVE-2025-22167 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-22167 being exploited in the wild.

**How severe is CVE-2025-22167?** Medium severity, with a CVSS score of 6.5, published 22 October 2025.

**Which products and versions are affected?** Atlassian Jira Data Center, Atlassian Jira Server. The advisory does not name versions.

**Is there a fix for CVE-2025-22167?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-22167?** Check whether you run Atlassian Jira Data Center or Atlassian Jira Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Atlassian Jira Data Center
- Atlassian Jira Server

## Related threats

- [Atlassian Jira Server and Data Center Path Traversal Vulnerability](https://junglewise.ai/threats/cve-2021-26086-atlassian-jira-server-and-data-center-path-traversal)
- [Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability](https://junglewise.ai/threats/cve-2019-11581-atlassian-jira-server-and-data-center-server-side-template)