CVE-2026-18516
CriticalCVSS 9.6Summary
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection.
Risk Assessment
An attacker can execute malicious script in the browser of a user viewing audit logs, potentially leading to session theft or actions performed as a logged-in administrator.
Recommendation
Update Crafty Controller to a version containing the fix, and consider restricting access to the panel and audit logs to trusted networks.
Other vulnerabilities in Crafty Controller
See all- CVE-2026-90821Medium
An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input.
- CVE-2026-13716Critical
Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.
- CVE-2025-14700Critical
An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection.
- CVE-2025-14701High
An input neutralization vulnerability in the Server MOTD component of Crafty Controller allows a remote, unauthenticated attacker to perform stored XSS via server MOTD modification.
Original NVD description (English source)
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection
Vulnerability data from NVD (NIST) · CISA KEV · EPSS