CVE-2026-13716

Description

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.

CVSS Vector

References

• https://gitlab.com/crafty-controller/crafty-4/-/work_items/727
• https://gitlab.com/crafty-controller/crafty-4/-/work_items/740
• https://gitlab.com/crafty-controller/crafty-4/-/work_items/727