Jira Data Center CVE-2025-22167

Exploitation requires a valid low-privilege authenticated account on the target Jira Software Data Center or Server instance (CVSS PR:L); it is remotely reachable over the network with no user interaction (AV:N/UI:N) and low complexity (AC:L). The vulnerability is a path-traversal arbitrary write constrained to filesystem paths writable by the Jira JVM process, so impact depends on which sensitive files (plugins, config, startup scripts) that process account can overwrite. Limiting factors: the mandatory authentication requirement excludes fully anonymous attackers, and affected deployments are specifically versions 9.12.0 through pre-9.12.28, 10.3.0 through pre-10.3.12, and 11.0.0; the exact triggering feature is not detailed in the public advisory.

This is a credible mid-tier priority rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) - the arbitrary-write primitive plausibly chains to code execution as the Jira JVM user, which justifies the 8.7 'High' rating. However, the exploitation signals temper the raw score: EPSS is only 0.50% (41st percentile), there is no CISA KEV listing, and no public exploit code is referenced, so there is no evidence of active or imminent mass exploitation. The authentication requirement (PR:L) is the single biggest mitigating factor, meaning an attacker must already hold a valid low-privilege Jira account, which narrows the realistic threat to insiders or post-credential-compromise scenarios. The signals are therefore internally consistent - high technical impact but low current exploitation probability - pointing to a 'patch promptly but not panic' posture. One caveat: the CVE was reported through Atlassian's internal program with no independent third-party disclosure, so technical specifics of the exact vulnerable endpoint are not public and cannot be verified beyond the vendor advisory.

An attacker holding a low-privilege authenticated Jira account sends a crafted request that abuses insufficient path validation to write a file outside the intended directory, to any location writable by the Jira JVM process. By overwriting a configuration file, plugin, or startup script, the attacker can escalate to arbitrary code execution on the server. No public exploit code is identified at time of analysis, and no user interaction is required.