Path Traversal and RCE in Crafty Controller

Executive Summary

CVE-2026-13716 is a path traversal vulnerability in Crafty Controller 4.10.7 that allows authenticated users with FILES permission to execute arbitrary code as the Crafty service account. The issue stems from improper validation of fileId and chunkId headers during chunked uploads, enabling attackers to write files to arbitrary paths and overwrite templates like offline.html, which can then execute malicious code.

Useful 0 Not Useful 0

Detection Guidance

Check Crafty Controller logs for unusual file uploads or path traversal attempts in the chunked-upload endpoint. Look for requests with fileId or chunkId headers containing ../ or absolute paths. Monitor for unexpected file writes outside the intended upload directory.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows remote code execution as the Crafty service account, potentially compromising confidentiality, integrity, and availability of data accessible to the panel. Attackers could tamper with files, cause denial of service via filesystem exhaustion, or further compromise the system. Exploitation requires only FILES permission, making it accessible to low-privileged users.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or data integrity issues, violating GDPR and HIPAA requirements for data protection, access control, and confidentiality. Compromise of the Crafty service account may expose sensitive data, leading to regulatory penalties and compliance failures.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the latest Crafty Controller patches addressing path traversal in file uploads. Restrict FILES and SERVER_CREATION permissions to trusted users only. Implement server-side generated upload IDs and validate chunkId as a bounded integer. Enforce path containment checks for all upload destinations.

Useful 0 Not Useful 0