What is the CVSS score of CVE-2026-0805?

CVE-2026-0805 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Crafty Controller are affected by CVE-2026-0805?

CVE-2026-0805 is a high-severity vulnerability in Crafty Controller's backup component that allows authenticated users to execute arbitrary code and modify files on affected systems.

How to fix or mitigate CVE-2026-0805?

Within 24 hours: Identify all systems running Crafty Controller and restrict administrative access to trusted personnel only. Within 7 days: Implement network segmentation to limit Crafty Controller exposure and enforce strong authentication controls; contact the vendor for patch timeline estimates. Within 30 days: Establish continuous monitoring for suspicious backup configuration changes and file modifications; develop incident response procedures specific to this vulnerability.

Crafty Controller CVE-2026-0805

HIGH

Path Traversal (CWE-22)

2026-01-30 cve@gitlab.com

RCE Path Traversal Crafty Controller Craftycontrol

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

CVE Published

Jan 30, 2026 - 07:16 nvd

HIGH 8.2

DescriptionCVE.org

An input neutralization vulnerability in the Backup Configuration component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.

AnalysisAI

Remote code execution in Crafty Controller's Backup Configuration feature results from insufficient path traversal validation, enabling authenticated attackers to manipulate files and execute arbitrary code on affected systems. The vulnerability requires valid credentials and specific conditions to exploit but carries high impact due to its ability to compromise system integrity and confidentiality. No patch is currently available.

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects the Backup Configuration component of Crafty Controller. An input neutralization vulnerability in the Backup Configuration component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.

RemediationAI

Monitor vendor advisories for a patch. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.