CVE-2026-13716

EUVD-2026-55949
Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.1 CRITICAL
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 43.41%
Common Weakness Enumeration
References
https://gitlab.com/crafty-controller/crafty-4/-/work_items/727
https://gitlab.com/crafty-controller/crafty-4/-/work_items/740
https://gitlab.com/crafty-controller/crafty-4/-/work_items/727