CVE-2026-13716

Analyzed Analyzed - Analysis Complete

Path Traversal and RCE in Crafty Controller

Publication date: 2026-08-11

Last updated on: 2026-08-18

Assigner: GitLab Inc.

Description

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-18

Generated

2026-08-31

AI Q&A

2026-08-11

EPSS Evaluated

2026-08-30

NVD

CVE-2026-13716

EUVD

EUVD-2026-55949

Affected Vendors & Products

Vendor	Product	Version / Range
craftycontrol	crafty_controller	From 4.4.0 (inc) to 4.10.8 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-35	The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.

Attack-Flow Graph

Executive Summary

CVE-2026-13716 is a path traversal vulnerability in Crafty Controller 4.10.7 that allows authenticated users with FILES permission to execute arbitrary code as the Crafty service account. The issue stems from improper validation of fileId and chunkId headers during chunked uploads, enabling attackers to write files to arbitrary paths and overwrite templates like offline.html, which can then execute malicious code.

Detection Guidance

Check Crafty Controller logs for unusual file uploads or path traversal attempts in the chunked-upload endpoint. Look for requests with fileId or chunkId headers containing ../ or absolute paths. Monitor for unexpected file writes outside the intended upload directory.

Impact Analysis

This vulnerability allows remote code execution as the Crafty service account, potentially compromising confidentiality, integrity, and availability of data accessible to the panel. Attackers could tamper with files, cause denial of service via filesystem exhaustion, or further compromise the system. Exploitation requires only FILES permission, making it accessible to low-privileged users.

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or data integrity issues, violating GDPR and HIPAA requirements for data protection, access control, and confidentiality. Compromise of the Crafty service account may expose sensitive data, leading to regulatory penalties and compliance failures.

Mitigation Strategies

Apply the latest Crafty Controller patches addressing path traversal in file uploads. Restrict FILES and SERVER_CREATION permissions to trusted users only. Implement server-side generated upload IDs and validate chunkId as a bounded integer. Enforce path containment checks for all upload destinations.

Hi! I’m here to help you understand CVE-2026-13716. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70