CVE-2025-6384 — Improper Control of Dynamically-Managed Code Resources in Crafter Studio

CVE-2025-6384

Improper Control of Dynamically-Managed Code Resources in Crafter Studio PUBLISHED

Description (CNA)

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass Sandbox restrictions and obtain RCE (Remote Code Execution). This issue affects CrafterCMS: from 4.0.0 through 4.2.2.

Affected (CNA)

Vendor / product	Versions
CrafterCMS / CrafterCMS	affected 4.0.0 before 4.3.0

CWE

CWE-913

References

https://docs.craftercms.org/current/security/advisory.html#cv-2025061901

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.