CVE-2026-13716: falha crítica em Arcadia Technology, LLC Crafty Controller
Path Traversal: '.../...//' in Crafty Controller
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.1epss 0.8%
Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
Produtos afetados
Arcadia Technology, LLC · Crafty ControllerCVEs relacionadas — Arcadia Technology, LLC Crafty Controller
No mesmo produto, das mais perigosas para as menos.
CVE-2025-14700CRITICALImproper Neutralization of Special Elements Used in a Template Engine in Crafty ControllerEPSS 6.6%CVE-2024-1064HIGHImproper Neutralization of HTTP Headers for Scripting Syntax in Crafty Controller 4EPSS 0.8%CVE-2026-0963CRITICALImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty ControllerEPSS 0.7%CVE-2026-0805HIGHImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty ControllerEPSS 0.7%CVE-2026-5652CRITICALAuthorization Bypass Through User-Controlled Key in Crafty ControllerEPSS 0.4%CVE-2025-14701HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty ControllerEPSS 0.3%