Description

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-11T06:17:12.870Z",
  "pubdate": "2026-08-11T06:17:12.870Z",
  "executiveSummary": "A path traversal vulnerability exists within the server import and admin file upload functionalities of Crafty Controller. This security flaw enables a remote, authenticated attacker to bypass directory restrictions and upload files to arbitrary file system paths that are accessible and permitted to the underlying Crafty Controller application context.\nThe primary impact of this vulnerability is arbitrary file write capability, which directly leads to remote code execution (RCE) on the host running the application. The affected system is Crafty Controller. The risk implications are severe, as successful exploitation compromises the confidentiality, integrity, and availability of the host system, allowing attackers to execute arbitrary commands or code with the privileges of the application.\nAttacker capabilities include authenticated remote access, arbitrary file deployment, and subsequent remote code execution. Exploitation requirements specified in the advisory include remote authentication and the ability to interact with the server import or admin file upload mechanisms within Crafty Controller. No further speculative prerequisites or external conditions are assumed beyond the described parameters.",
  "technicalDetails": "The root cause of the vulnerability resides in insufficient input validation and sanitization of file names and destination paths handled by the server import and admin file upload routines in Crafty Controller. When processing file uploads or server import archives, the application fails to adequately neutralize directory traversal sequences (such as dot-dot-slash patterns) or enforce strict boundary checks against the intended destination directory.\nThe vulnerable components are the server import module and the admin file upload functionality within the Crafty Controller application. The authentication requirements dictate that the attacker must be authenticated to the application to access the vulnerable upload or import interfaces. Privilege requirements include access levels permitted to utilize server import or admin file upload features. The network exposure is remote, as Crafty Controller is typically accessed over a network interface.\nThe step-by-step attack flow proceeds as follows: First, the authenticated attacker crafts a malicious file or archive containing directory traversal sequences within its metadata or file path parameters. Second, the attacker submits this payload via the vulnerable server import or admin file upload mechanism. Third, the Crafty Controller application processes the input without properly sanitizing the target path, causing the file write operation to traverse outside the designated upload directory. Fourth, the attacker writes a malicious payload (such as a web shell or executable script) to an arbitrary, writable path permitted to the application context.\nThe post-exploitation impact centers on remote code execution. By placing executable code or overwriting existing application scripts and binaries within execution paths accessible to the system or application, the attacker achieves arbitrary code execution, thereby compromising the underlying host environment."
}