CVE-2026-0963 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controller

CVE-2026-0963

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controller PUBLISHED

Description (CNA)

An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.

Affected (CNA)

Vendor / product	Versions
Arcadia Technology, LLC / Crafty Controller	affected 4.7.0 before 4.8.0

CWE

CWE-22

References

https://gitlab.com/crafty-controller/crafty-4/-/issues/660

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.