# CVE-2023-26255: Jira - Path Traversal

> Live exploitation tracking for CVE-2023-26255 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2023-26255

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.5
- **Public exploit available:** Yes
- **Affected products:** Atlassian Jira
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** enterprise_software

## Description

An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira. By modifying the fileName parameter to the snjCustomDesignConfig endpoint, it is possible to traverse and read the file system.

## CrowdSec analysis

[CVE-2023-26255](https://euvd.enisa.europa.eu/vulnerability/CVE-2023-26255) is a path traversal vulnerability affecting the "STAGIL Navigation for Jira - Menu & Themes" plugin. An attacker can exploit this weakness to read arbitrary files on the system by manipulating requests to a specific plugin endpoint.

CrowdSec has been tracking this vulnerability and its exploits since 7th of May 2025.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2023-26255 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2023-26255 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2023-26255 is currently experiencing high visibility and active exploitation across the internet.

Detected exploitation attempts typically target URLs containing `/plugins/servlet/snjcustomdesignconfig`.

## Timeline

- 2023-02-28: CVE Published. CVE-2023-26255 is published to NVD.
- 2025-05-07: Rule Released. CrowdSec releases a rule to detect CVE-2023-26255 exploitation attempts against the CrowdSec Network.
- 2025-05-07: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2023-26255 for the first time.

## References

- https://marketplace.atlassian.com/apps/1216090/stagil-navigation-for-jira-menus-themes?tab=overview&hosting=cloud
- https://github.com/1nters3ct/CVEs/blob/main/CVE-2023-26255.md
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26255.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2023-26255) follows observed exploitation activity for CVE-2023-26255. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.