CRITICAL 9.1 NVD
CVE-2026-13716
Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted
Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.
References
- https://gitlab.com/crafty-controller/crafty-4/-/work_items/727
- https://gitlab.com/crafty-controller/crafty-4/-/work_items/740
This critical severity vulnerability with a CVSS score of 9.1 was published on 2026-08-11 via NVD.
Risk Timeline
CVE Disclosed2026-08-11 · -1 days ago
Remediation Resources
Analysis & PoC
gitlab.com/crafty-controller/crafty-4/-/work_items/727Analysis & PoC
gitlab.com/crafty-controller/crafty-4/-/work_items/740
vulnfeed aggregates 10103 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.