CVE-2026-13716

9.1 Critique

Publiée le 11/08/2026 à 08:17 · Modifiée le 18/08/2026 à 20:06 · Analysée par le NVD · Source : cve@gitlab.com

Description

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.

Traduire en français

Produits concernés

Arcadia Technology, LLC Crafty Controller
Craftycontrol crafty controller

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.1 Critique	cve@gitlab.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L`

Faiblesses (CWE)

CWE-35

Références

https://gitlab.com/crafty-controller/crafty-4/-/work_items/727 ExploitVendor Advisory
https://gitlab.com/crafty-controller/crafty-4/-/work_items/740 ExploitMitigationVendor Advisory
https://gitlab.com/crafty-controller/crafty-4/-/work_items/727 ExploitVendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories