CVE-2026-0963: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controller
Published Jan 30, 2026
·Updated
An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.
Affected Software
2 affected components
Crafty Controller Crafty Controller
Craftycontrol Crafty Controller=4.7.0
Remediation
Information
Upgrade to version 4.8.0
Event History
Jan 30, 2026
CVE Published
via MITRE·06:04 AM
Data Sourced
via MITRE·06:04 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·07:16 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-0963?
CVE-2026-0963 is considered a critical vulnerability due to the potential for remote code execution.
2
How do I fix CVE-2026-0963?
To fix CVE-2026-0963, update Crafty Controller to the latest version where the vulnerability is patched.
3
What type of attack can be executed using CVE-2026-0963?
CVE-2026-0963 allows an authenticated attacker to perform file tampering and remote code execution.
4
What component of Crafty Controller is affected by CVE-2026-0963?
CVE-2026-0963 affects the File Operations API Endpoint component of Crafty Controller.
5
Who is vulnerable to CVE-2026-0963?
Any user of an unpatched version of Crafty Controller is vulnerable to CVE-2026-0963.