CVE-2025-14700: Improper Neutralization of Special Elements Used in a Template Engine in Crafty Controller

Published Dec 17, 2025

Updated

An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection.

Affected Software

2 affected components

Crafty Controller Crafty Controller

Craftycontrol Crafty Controller=4.6.1

Remediation

Information

Upgrade to version 4.6.2

Event History

Dec 17, 2025

CVE Published

via MITRE·12:04 AM

Data Sourced

via MITRE·12:04 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-14700?

CVE-2025-14700 has been assigned a severity rating that indicates a significant risk due to its potential for remote code execution.

How do I fix CVE-2025-14700?

To fix CVE-2025-14700, update Crafty Controller to the latest version that includes the patch for the input neutralization vulnerability.

Who is affected by CVE-2025-14700?

CVE-2025-14700 affects users of Crafty Controller, specifically those utilizing the Webhook Template component.

Can CVE-2025-14700 be exploited without authentication?

No, CVE-2025-14700 requires an authenticated attacker to exploit the vulnerability.

What is the risk of not addressing CVE-2025-14700?

Not addressing CVE-2025-14700 puts systems at risk of remote code execution, potentially leading to unauthorized access and data compromise.