What is CVE-2026-13716?
A path traversal vulnerability in the server import and admin file upload features of Crafty Controller. This allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the application and achieve remote code execution (RCE). Immediate update to the latest version of Crafty Controller is strongly recommended.
Azərbaycanca: Crafty Controller-da server idxalı və admin fayl yükləmə funksiyalarında tapılan 'Path traversal' zəifliyidir. Bu boşluq autentifikasiyadan keçmiş uzaqdan hücumçuya, tətbiqin icazə verdiyi ixtiyari qovluqlara fayl yükləməyə və uzaqdan kod icrası (RCE) həyata keçirməyə imkan verir. Təcili olaraq Crafty Controller-i ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-22
FAQ2
Which features of Crafty Controller are affected by CVE-2026-13716?
This vulnerability affects the server import and admin file upload features of Crafty Controller.
What can an authenticated attacker achieve by exploiting CVE-2026-13716?
They can upload files to arbitrary paths permitted to the application and achieve remote code execution (RCE).
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.