CVE-2026-13716

EUVD-2026-55949
Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.1 CRITICAL
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 54.79%
Affected Products (NVD)
VendorProductVersion
craftycontrolcrafty_controller
4.4.0 ≤
𝑥
< 4.10.8
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://gitlab.com/crafty-controller/crafty-4/-/work_items/727
https://gitlab.com/crafty-controller/crafty-4/-/work_items/740
https://gitlab.com/crafty-controller/crafty-4/-/work_items/727