CVE-2026-0963 — CRITICAL (9.9)

Vulnerability Description

An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.

CVSS Score

9.9

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

LOW

Affected Products

Vendor	Product	Versions
Craftycontrol	Crafty Controller	4.7.0

Related Weaknesses (CWE)

CWE-22

References

https://gitlab.com/crafty-controller/crafty-4/-/issues/660Broken Link

FAQ

What is CVE-2026-0963?

CVE-2026-0963 is a vulnerability with a CVSS score of 9.9 (CRITICAL). An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via...

How severe is CVE-2026-0963?

CVE-2026-0963 has been rated CRITICAL with a CVSS base score of 9.9/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2026-0963?

Check the references section above for vendor advisories and patch information. Affected products include: Craftycontrol Crafty Controller.