Crafty Controller
CVE-2025-14701
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Crafty Controller web interface
-
DeliverySubmit crafted MOTD via server modification
-
ExploitMalicious script stored unsanitized
-
ExecutionOperator views panel page
-
PersistScript executes in admin session
-
ImpactHijack session or perform panel actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to reach the Crafty Controller web application and submit a modified Server MOTD (the vulnerable component), which per the vector requires no authentication (PR:N). Execution is gated on operator interaction (UI:R): a logged-in Crafty Controller user must subsequently view the panel page that renders the stored MOTD for the payload to fire in their browser. Limiting factors: the payload only executes in the context of whoever views the affected view, the product is a niche self-hosted Minecraft management panel with limited deployment, and no affected/fixed version boundary is published to scope exposure. |
| Impact | This is a moderate-severity stored XSS (CVSS 7.1, CWE-79) in the Server MOTD component of Crafty Controller, a self-hosted Minecraft server management panel. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) indicates a network-reachable, low-complexity, unauthenticated injection that requires victim interaction (UI:R) - consistent with a stored payload that fires when an operator later views the panel. EPSS is low at 0.29% (19th percentile), there is no CISA KEV listing, and no public exploit code is referenced (the only reference is the vendor's own GitLab issue #647), so this is 'no public exploit identified at time of analysis' rather than an actively-exploited priority. The most notable tension is the C:H confidentiality rating: pure XSS more commonly warrants C:L, and the reporter (GitLab/cve@gitlab.com) likely justified C:H on the basis that stealing an admin session in a panel that controls server consoles could cascade to full compromise - this is an impact-chain argument, not a direct base-metric impact, and should be treated with caution. Overall this is a real-but-not-urgent web-app hygiene bug: unauthenticated and network-facing, but gated on operator interaction and confined to a niche product, with no evidence of exploitation in the wild. |
| Exploit ScenarioDerived | A remote unauthenticated attacker modifies a server MOTD with a crafted payload containing malicious markup/script; because input is not neutralized, the payload is stored. When a Crafty Controller operator later opens the panel view that renders the MOTD, the script executes in their authenticated browser session, enabling session/token theft or actions in the panel context. No public POC is referenced beyond the vendor GitLab issue. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Stored cross-site scripting (CWE-79) in the Server MOTD component of Crafty Controller, a self-hosted Minecraft server management panel, allows a remote, unauthenticated attacker to submit a crafted MOTD that is stored by the application and later rendered in the browser of any logged-in panel user who views the affected page (CVSS 3.1 base 7.1, AV:N/AC:L/PR:N/UI:R). Because the payload fires only in the viewing user's browser session, the practical impact is limited to confidentiality and integrity compromise of that session rather than server takeover, and the vulnerability affects a niche, self-hosted product with limited deployment plus no published affected/fixed version boundary to scope exposure. No public exploit code has been identified at time of analysis and the EPSS score is low at 0.29% (19th percentile) with no CISA KEV listing, so there is currently no evidence of active exploitation.
RemediationAI
No vendor-released patch identified at time of analysis and no fixed version is published in the available intelligence - the only upstream pointer is the GitLab issue at https://gitlab.com/crafty-controller/crafty-4/-/issues/647, which should be monitored for a fixed release; do not assume a specific patched version until the vendor states one. Practical compensating controls: place the Crafty Controller panel behind a reverse proxy or VPN with an IP allowlist so that unauthenticated submission of a MOTD payload cannot reach the vulnerable endpoint (trade-off: blocks remote or roaming administrators and requires a jump host); where the MOTD input path can be reached without authentication, enforce authentication at the proxy layer for all panel routes (trade-off: may break intended public status pages); temporarily clear the Server MOTD field or suppress rendering of stored MOTD text in the panel to remove the sink (trade-off: loses a cosmetic/status feature and does not fix any other stored-XSS sinks); deploy a strict Content-Security-Policy that forbids inline and third-party script on the panel to blunt payload execution (trade-off: the panel may not function if it relies on inline scripts, so test before enforcing); and rotate or invalidate active panel sessions and review logs for suspicious MOTD writes as a detection measure, since exploitation requires a victim to view the poisoned MOTD rather than any privileged server action. Because exploitation is gated on user interaction (UI:R) and the flaw's impact is confined to the viewing user's browser context, prioritizing external exposure reduction of the panel is a proportionate interim measure while awaiting an upstream fix.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored variant: the Server MOTD field accepted by Crafty Controller is persisted and subsequently emitted into panel HTML without adequate output encoding or contextual escaping, so attacker-supplied markup is interpreted as script by the browser of whoever views that view. Crafty Controller (CPE cpe:2.3:a:craftycontrol:crafty_controller, referenced against the crafty-4 codebase per the linked GitLab issue) is a self-hosted web control panel for managing Minecraft servers; the MOTD is an operator-visible text field that the panel renders back to authenticated users, which is what turns a stored-input flaw into cross-site scripting. The assessed vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - reachable remotely with no authentication required to inject the payload (PR:N), but execution is gated on user interaction (UI:R) because a logged-in panel user must navigate to the page that renders the stored MOTD; the scope change (S:C) reflects that the script executes in the victim's browser security context rather than the application's. The wildcard CPE (*) means no version boundary is published, so affected revisions cannot be enumerated from advisory data, and the sole reference (GitLab issue 647) is a project issue tracker entry rather than a versioned vendor security advisory.
Know when Crafty Controller gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Unauthenticated network injection (PR:N/AV:N) that fires in a victim's browser on view (UI:R, S:C); stored XSS yields limited direct C:L/I:L, not C:H.
Primary rating from Vendor (gitlab).
CVSS VectorVendor: gitlab
DescriptionCVE.org
An input neutralization vulnerability in the Server MOTD component of Crafty Controller allows a remote, unauthenticated attacker to perform stored XSS via server MOTD modification.
Executive ViewAI
Crafty Controller, a self-hosted Minecraft server management panel, is affected by a high-severity stored cross-site scripting vulnerability that could allow an unauthenticated attacker to compromise the browser sessions of logged-in administrators. No vendor-released patch identified at time of analysis, and there is no public exploit identified at time of analysis. Although the product has limited deployment, successful exploitation could lead to unauthorized actions within the panel and potential lateral movement, requiring leadership attention.
Restrict access to trusted networks, enforce multi-factor authentication, implement WAF rules to block XSS payloads, monitor logs for suspicious MOTD submissions, and consider disabling the MOTD feature until a patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)CVE.org
More in Crafty Controller
View allStored cross-site scripting (XSS) vulnerability in Crafty Controller that allows authenticated attackers to inject malic
A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticate
Path traversal in Crafty Controller game server management allows authenticated attackers to read/write files outside th
Stored cross-site scripting in the Audit Logs component of Crafty Controller (the crafty-4 project by Arcadia Technology
Remote code execution in Crafty Controller (crafty-4), a web-based management panel for Minecraft servers, arises from p
Crafty Controller Users API allows authenticated administrators with high privileges to modify other user accounts due t
Remote code execution in Crafty Controller's Backup Configuration feature results from insufficient path traversal valid
Stored cross-site scripting in the Webhook URL form field of Crafty Controller allows an authenticated user with access
GitHub PoC
Exploit-DB