Crafty Controller vulnerabilities

3 known CVE vulnerabilities in Crafty Controller, translated and rated.

CVE-2026-13716Critical
Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.
CVE-2025-14700Critical
An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection.
CVE-2025-14701High
An input neutralization vulnerability in the Server MOTD component of Crafty Controller allows a remote, unauthenticated attacker to perform stored XSS via server MOTD modification.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS