CVE-2026-0805 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controller

CVE-2026-0805

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controller PUBLISHED

Description (CNA)

An input neutralization vulnerability in the Backup Configuration component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.

Affected (CNA)

Vendor / product	Versions
Arcadia Technology, LLC / Crafty Controller	affected 4.5.0 before 4.8.0

CWE

CWE-22

References

https://gitlab.com/crafty-controller/crafty-4/-/issues/650

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.