Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://gitlab.com/crafty-controller/crafty-4/-/work_items/727 Exploit, Vendor Advisory
- https://gitlab.com/crafty-controller/crafty-4/-/work_items/740 Exploit, Mitigation, Vendor Advisory
- https://gitlab.com/crafty-controller/crafty-4/-/work_items/727 Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.1 · craftycontrolNVD modified 2026-10-23 19:10
Affected (CPE criteria) 1
cpe:2.3:a:craftycontrol:crafty_controller:*:*:*:*:*:*:*:*
References 3
- https://gitlab.com/crafty-controller/crafty-4/-/work_items/727 Exploit, Vendor Advisory
- https://gitlab.com/crafty-controller/crafty-4/-/work_items/740 Exploit, Mitigation, Vendor Advisory
- https://gitlab.com/crafty-controller/crafty-4/-/work_items/727 Exploit, Vendor Advisory