What’s Vulnerable › Vulnerabilities

CVE-2023-26255

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 47.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-02-28 · updated 2026-06-17
• Weakness: CWE-22

Description

An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira. By modifying the fileName parameter to the snjCustomDesignConfig endpoint, it is possible to traverse and read the file system.

Affected products

• Stagil Navigation: before 2.0.52 — fixed in 2.0.52

How to fix

Upgrade to a fixed version: Stagil Navigation 2.0.52. Check the vendor advisory for mitigations.

References

• https://github.com/1nters3ct/CVEs/blob/main/CVE-2023-26255.md
• https://marketplace.atlassian.com/apps/1216090/stagil-navigation-for-jira-menus-themes?tab=overview&hosting=cloud
• https://github.com/1nters3ct/CVEs/blob/main/CVE-2023-26255.md
• https://marketplace.atlassian.com/apps/1216090/stagil-navigation-for-jira-menus-themes?tab=overview&hosting=cloud

Get alerted when CVE-2023-26255 or the next vulnerability affects your stack