CVE-2026-13716: Path Traversal: '.../...//' in Crafty Controller
Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Crafty Controllerto a version that resolves this vulnerability.Fixed in 4.10.8
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13716?
The severity of CVE-2026-13716 is classified as critical with a score of 9.1.
How do I fix CVE-2026-13716?
To fix CVE-2026-13716, ensure that input validation is performed on file paths and restrict upload permissions appropriately.
What type of vulnerability is CVE-2026-13716?
CVE-2026-13716 is a path traversal vulnerability that allows unauthorized file access on the server.
What impact does CVE-2026-13716 have on Crafty Controller?
CVE-2026-13716 allows remote authenticated attackers to upload files to arbitrary paths, potentially leading to remote code execution.
Who is affected by CVE-2026-13716?
Users of Crafty Controller who have enabled file upload features may be affected by CVE-2026-13716.