CVE-2026-1770 — Improper Control of Dynamically-Managed Code Resources in Crafter Studio

CVE-2026-1770

Improper Control of Dynamically-Managed Code Resources in Crafter Studio PUBLISHED

Description (CNA)

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE (Remote Code Execution).

Affected (CNA)

Vendor / product	Versions
CrafterCMS / CrafterCMS	affected 4.0.0 before 4.5.0

CWE

CWE-913

References

https://docs.craftercms.org/current/security/advisory.html#cv-2026020201

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.