Jira Server/Data Center STAGIL Navigation plugin Path Traversal CVE-2023-26256

high Nessus Plugin ID 183745


The remote JIRA application has plugins installed on the remote host.


The Atlassian JIRA application running on the remote host has plugins enabled. It is ,therefore, potentially affected by an unauthenticated path traversal vulnerability affecting the 'STAGIL Navigation for Jira - Menu & Themes' plugin before 2.0.52. By modifying the fileName parameter to the snjFooterNavigationConfig endpoint, it is possible to traverse and read the file system. (CVE-2023-26256)


Upgrade the 'STAGIL Navigation for Jira - Menu & Themes' plugin to version 2.0.52 or later.

See Also


Plugin Details

Severity: High

ID: 183745

File Name: jira_CVE-2023-26256.nbin

Version: 1.9

Type: remote

Family: Web Servers

Published: 10/23/2023

Updated: 5/20/2024

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information


Risk Factor: Medium

Score: 4.4


Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2023-26256


Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:atlassian:jira, cpe:/a:stagil:stagil_navigation

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/9/2023

Vulnerability Publication Date: 2/28/2023

Reference Information

CVE: CVE-2023-26256