IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
8.7High

CVE-2025-22167

Atlassian Jira Software Data Center; Atlassian Jira Software Server Published: (1 year ago)

Description

This High severity Path Traversal (Arbitrary Write) vulnerability was introduced in versions: 9.12.0, 10.3.0 and remain present in 11.0.0 of Jira Software Data Center and Server. This Path Traversal (Arbitrary Write) vulnerability, with a CVSS Score of 8.7, allows an attacker to modify any filesystem path writable by the Jira JVM process. Atlassian recommends that Jira Software Data Center and Server customers upgrade to the latest version; if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Jira Software Data Center and Server 9.12: Upgrade to a release greater than or equal to 9.12.28 Jira Software Data Center and Server 10.3: Upgrade to a release greater than or equal to 10.3.12 Jira Software Data Center and Server 11.0: Upgrade to a release greater than or equal to 11.1.0 See the release notes. You can download the latest version of Jira Software Data Center and Server from the download center. This vulnerability was reported via our Atlassian (Internal) program.

Weakness (CWE): CWE-22

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
atlassian jira data center 9.12.0 – < 9.12.28
atlassian jira server 9.12.0 – < 9.12.28
Atlassian Jira Software Data Center 11.0.0 to 11.0.1, 10.3.0 to 10.3.11, 9.12.0 to 9.12.27, fixed 11.1.0 to 11.1.1, fixed 10.3.12, fixed 9.12.28
Atlassian Jira Software Server 9.12.0 to 9.12.27, fixed 9.12.28

References and patches

CPE matches (NVD) (6)
  • cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* ≥ 9.12.0 < 9.12.28
  • cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* ≥ 10.3.0 < 10.3.12
  • cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* ≥ 11.0.0 < 11.1.0
  • cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* ≥ 9.12.0 < 9.12.28
  • cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* ≥ 10.3.0 < 10.3.12
  • cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* ≥ 11.0.0 < 11.1.0

Recent CVEs in the same product — Atlassian Confluence / Jira

9.3Critical
CVE-2026-21589 KEV

Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Atlassian Bamboo Data Center; Atlassian Bitbucket Data Center; Atlassian Confluence Data Center; Atlassian Crowd Data Center

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthent…

100%EPSS
7.1High
CVE-2026-21586
Atlassian Confluence Data Center

This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Improper Authorization vulnerability, with …

7.1High
CVE-2026-21587
Atlassian Jira Service Management Data Center

This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to gain unintended acces…

7.1High
CVE-2026-21588
Atlassian Confluence Data Center

This High severity DoS (Denial of Service) vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 7.1,…

8.6High
CVE-2026-21580
Atlassian Confluence Data Center; Atlassian Confluence Server

This Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 1…

7.1High
CVE-2026-21577
Atlassian Confluence Data Center

This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 7.1, allows …