CVE-2026-0963
📋 TL;DR
An input neutralization vulnerability in Crafty Controller's File Operations API Endpoint allows authenticated attackers to perform path traversal attacks, leading to file tampering and remote code execution. This affects all Crafty Controller installations with vulnerable versions exposed to authenticated users.
💻 Affected Systems
- Crafty Controller
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via remote code execution, allowing attacker to execute arbitrary commands, access sensitive data, and pivot to other systems.
Likely Case
Unauthorized file access and modification, potentially leading to service disruption, data theft, or privilege escalation.
If Mitigated
Limited impact if proper network segmentation and authentication controls prevent unauthorized access to the vulnerable endpoint.
🎯 Exploit Status
Exploitation requires authenticated access but path traversal vulnerabilities are typically easy to exploit once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check the GitLab issue for specific fixed version
Vendor Advisory: https://gitlab.com/crafty-controller/crafty-4/-/issues/660
Restart Required: Yes
Instructions:
1. Check the GitLab issue for the specific fixed version. 2. Update Crafty Controller to the patched version. 3. Restart the Crafty Controller service.
🔧 Temporary Workarounds
Restrict API Access
allLimit access to the File Operations API endpoint using network controls or web application firewall rules.
Implement Input Validation
allAdd input validation to reject path traversal sequences in file operation requests.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Crafty Controller from sensitive systems
- Enforce strong authentication and limit user privileges to minimize attack surface
🔍 How to Verify
Check if Vulnerable:
Check Crafty Controller version against the vulnerable range specified in the GitLab issue.Check Version:
Check Crafty Controller web interface or configuration files for version informationVerify Fix Applied:
Verify the Crafty Controller version matches or exceeds the patched version mentioned in the advisory.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns
- Path traversal sequences in API requests
- Unauthorized file modification attempts
Network Indicators:
- Suspicious requests to File Operations API endpoint with path traversal payloads
SIEM Query:
source="crafty-controller" AND (uri="*../*" OR uri="*..\\*" OR method="POST" AND uri="*/api/file*")