CVE-2026-13716

Published: Ago 11, 2026 Last Modified: Ago 11, 2026

ExploitDB:

Other exploit source:

Google Dorks:

CRITICAL 9,1

Source: [email protected]

Attack Vector: network

Attack Complexity: low

Privileges Required: low

User Interaction: none

Scope: changed

Confidentiality: low

Integrity: high

Availability: low

Description

AI Translation Available

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.

Path Traversal: '.../...//'

Incomplete

Abstraction: Variant Structure: Simple

Common Consequences

Security Scopes Affected:

Confidentiality Integrity

Potential Impacts:

Read Files Or Directories Modify Files Or Directories Bypass Protection Mechanism

Applicable Platforms

All platforms may be affected

View CWE Details

https://gitlab.com/crafty-controller/crafty-4/-/work_items/…

https://gitlab.com/crafty-controller/crafty-4/-/work_items/727