CVE-2025-14700

Improper Neutralization of Special Elements Used in a Template Engine in Crafty Controller PUBLISHED

Description (CNA)

An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection.

Affected (CNA)

Vendor / product	Versions
Arcadia Technology, LLC / Crafty Controller	affected 4.6.1

CWE

CWE-1336

References

https://gitlab.com/crafty-controller/crafty-4/-/issues/646

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.