Craftycontrol Crafty Controller vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Craftycontrol Crafty Controller: 6 record(s), with affected versions and fixes.cpe:2.3:a:craftycontrol:crafty_controller
CVE-2026-13716
Critical · 9.1
CWE-35 Aug 11, 2026
Path traversal in server import and admin file upload in Crafty Controller. Allows a…
Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.
CVE-2026-5652
Critical · 9.0
CWE-639 Apr 21, 2026
Authorization Bypass Through User-Controlled Key in Crafty Controller
An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation.
CVE-2026-0963
High · 8.8
CWE-22 Jan 30, 2026
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controller
An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.
CVE-2026-0805
High · 8.8
CWE-22 Jan 30, 2026
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controller
An input neutralization vulnerability in the Backup Configuration component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.
CVE-2025-14701
High · 7.1
CWE-79 Dec 16, 2025
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller
An input neutralization vulnerability in the Server MOTD component of Crafty Controller allows a remote, unauthenticated attacker to perform stored XSS via server MOTD modification.
CVE-2025-14700
Critical · 9.9
CWE-1336 Dec 16, 2025
Improper Neutralization of Special Elements Used in a Template Engine in Crafty Controller
An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection.