CVE-2023-26255: STAGIL Navigation for Jira path traversal allows unauthenticated file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityUnauthenticated network-accessible path traversal with high confidentiality impact and a public exploit, though no KEV listing or ransomware use is documented.

What it is

The STAGIL Navigation for Jira - Menu & Themes plugin before 2.0.52 contains a path traversal flaw in the snjCustomDesignConfig endpoint. An attacker can modify the fileName parameter to escape the intended directory and read arbitrary files from the server filesystem. Because the endpoint is unauthenticated, any network-reachable Jira instance with the vulnerable plugin is exposed.

Impact

An unauthenticated attacker can read files accessible to the Jira process, potentially exposing configuration files, credentials, or other sensitive data. There is no integrity or availability impact per the CVSS vector.

Attack surface

Reachable over the network via HTTP requests to the snjCustomDesignConfig endpoint with a crafted fileName parameter. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

No CISA KEV listing, but EPSS is 0.47199 (98.8th percentile) and a public exploit reference is tagged Exploit, indicating active interest and available proof-of-concept code.

What to do

• Upgrade the STAGIL Navigation for Jira plugin to version 2.0.52 or later.
• If immediate patching is not possible, restrict network access to the Jira instance and the snjCustomDesignConfig endpoint to trusted users or networks.
• Review Jira and plugin logs for requests to snjCustomDesignConfig with suspicious fileName parameters.
• Rotate any credentials or secrets that may have been stored in files readable by the Jira process.

Detection

• Search web access logs for requests to the snjCustomDesignConfig endpoint with path traversal sequences (e.g., ../) in the fileName parameter.
• Monitor for anomalous file read activity by the Jira process, especially access to files outside the plugin or Jira directories.
• Alert on unauthenticated requests to plugin endpoints that normally require authentication.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.