CVE-2023-26255

HIGH EXPLOITED NUCLEI

STAGIL Navigation for Jira <2.0.52 - Path Traversal

Title source: llm

Description

An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira. By modifying the fileName parameter to the snjCustomDesignConfig endpoint, it is possible to traverse and read the file system.

Exploits (3)

nomisec WORKING POC
by Nian-Stars · infoleak
https://github.com/Nian-Stars/CVE-2023-26255-6
nomisec SUSPICIOUS
by tucommenceapousser · poc
https://github.com/tucommenceapousser/CVE-2023-26255-Exp
vulncheck_xdb WORKING POC
infoleak
https://github.com/jcad123/CVE-2023-26256

Nuclei Templates (1)

STAGIL Navigation for Jira Menu & Themes <2.0.52 - Local File Inclusion
HIGHby DhiyaneshDK
Shodan: title:Jira || http.title:jira
FOFA: title=jira

References (2)

Scores

CVSS v3 7.5
EPSS 0.9356
EPSS Percentile 99.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

VulnCheck KEV 2023-07-18
CWE
CWE-22
Status published
Products (1)
stagil/stagil_navigation < 2.0.52
Published Feb 28, 2023
Tracked Since Feb 18, 2026