CVE-2026-18516: Improper Encoding or Escaping of Output in Crafty Controller
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Crafty Controllerto a version that resolves this vulnerability.Fixed in 4.11.0 - Compensating control
Make Crafty Controller accessible only behind a reverse proxy that blocks injection of the X-Real-IP and X-Forwarded-For headers
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker can be remote and unauthenticated, and exploitation is performed through HTTP header injection. Successful exploitation still requires user interaction, as indicated by the UI:R vector.
Which part of the application is involved?
The vulnerability is in the Audit Logs component. Injected content can be stored and later executed as cross-site scripting when affected audit log output is viewed.
What is the likely impact if exploitation succeeds?
The supplied severity vector indicates high confidentiality, integrity, and availability impact, with scope changed. This means successful stored XSS may affect users or components beyond the vulnerable component's original security authority.