CVE-2026-13716

Name of the Vulnerable Software and Affected Versions Crafty Controller (affected versions not specified)

Description Path traversal exists in the server import and admin file upload features. This allows a remote, authenticated attacker to upload files to arbitrary paths accessible to the application, which can lead to remote code execution. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with dot-dot-slash (../) sequences.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.