CVE-2026-13716

CRITICAL 9.1

Path Traversal: '.../...//' in Crafty Controller

CVSS Score

9.1

EPSS Score

0.0%

EPSS Percentile

0th

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.

CWE	CWE-35
Vendor	arcadia technology, llc
Product	crafty controller
Published	Aug 11, 2026

Stay Ahead of the Next One

Get instant alerts for arcadia technology, llc crafty controller

Be the first to know when new critical vulnerabilities affecting arcadia technology, llc crafty controller are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

Low

Affected Versions

Arcadia Technology, LLC / Crafty Controller

4.4.0 ≤ 4.10.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

gitlab.com: https://gitlab.com/crafty-controller/crafty-4/-/work_items/727 gitlab.com: https://gitlab.com/crafty-controller/crafty-4/-/work_items/740

Credits

Thank you to [George Chen](https://gitlab.com/geo-chen) on Gitlab for reporting this issue. Thank you to [Metin Durmuş](https://gitlab.com/durmus38metin) on GitLab for contributing to this issue.