An input neutralization vulnerability in the Backup Configuration component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:NCraftycontrol Crafty Controller
APPCraftycontrol4.5.0 – 4.8.0 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEPath Traversal
CWE
Related vulnerabilities
CVE-2026-13716CRITICAL9.1same product
Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated att...
CVE-2026-5652CRITICAL9.0PL ✓same product
IDOR w Crafty Controller — nieautoryzowana modyfikacja kont użytkowników
CVE-2026-0963CRITICAL9.9PL ✓same product
Path Traversal umożliwiający RCE w Crafty Controller (File Operations API)
CVE-2025-14700CRITICAL9.9PL ✓same product
RCE przez Server Side Template Injection w Crafty Controller (Webhook Template)
CVE-2025-14701HIGH7.1same product
An input neutralization vulnerability in the Server MOTD component of Crafty Controller allows a remote, unaut...