Path Traversal in Crafty Controller File API Enables RCE

Publication date: 2026-01-30

Last updated on: 2026-02-26

Assigner: GitLab Inc.

Description

An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-30

Last Modified

2026-02-26

Generated

2026-07-06

AI Q&A

2026-01-30

EPSS Evaluated

2026-07-05

NVD

CVE-2026-0963

Affected Vendors & Products

Vendor	Product	Version / Range
craftycontrol	crafty_controller	4.7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is an input neutralization flaw in the File Operations API Endpoint component of Crafty Controller. It allows a remote, authenticated attacker to exploit path traversal to tamper with files and execute remote code on the affected system.

Impact Analysis

The vulnerability can lead to severe impacts including unauthorized file tampering and remote code execution, which may compromise the confidentiality, integrity, and availability of the affected system.

Hi! I’m here to help you understand CVE-2026-0963. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70