Path Traversal Arbitrary File Write in Atlassian Jira Software Data Center and Server

An attacker can write or modify files at arbitrary paths that are writable by the Jira JVM process. Depending on the Jira deployment, filesystem permissions, and reachable writable locations, this can lead to application tampering, configuration manipulation, data corruption, persistence, denial of service, or potentially further compromise if written files are later interpreted or executed by the application or host environment.

If immediate upgrade is not possible, reduce risk by limiting access to Jira to trusted users and networks, restricting exposure of administrative and sensitive application functionality, and ensuring the Jira JVM process runs with the minimum filesystem privileges necessary. Constrain write permissions on the host so the Jira process cannot modify sensitive system, application, or web-accessible paths. Monitor for unexpected file creation or modification by the Jira process. The provided content does not include any vendor-specified temporary workaround beyond upgrading.

Atlassian recommends upgrading Jira Software Data Center and Server to a fixed release. The provided fixed versions are: Jira 9.12.x to 9.12.28 or later, Jira 10.3.x to 10.3.12 or later, and Jira 11.0.x to 11.1.0 or later. If possible, upgrade to the latest available version from Atlassian.