EUVD-2026-55949
GHSA-2m7h-5589-9pp5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
Network-reachable panel with low-privileged auth (PR:L) and no interaction; traversal-to-RCE yields full C/I/A impact on the host process, scoring 8.8 with S:U.
Primary rating from Vendor (gitlab).
CVSS VectorVendor: gitlab
Lifecycle Timeline
2DescriptionCVE.org
Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.
AnalysisAI
Remote code execution in Crafty Controller (crafty-4), a web-based management panel for Minecraft servers, arises from path traversal in the server-import and admin file-upload features that lets an authenticated user write files to arbitrary filesystem paths accessible to the application. By planting a file in an executable or auto-loaded location, a low-privileged authenticated attacker can escalate to code execution in the context of the Crafty Controller process. No public exploit has been identified at the time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.
Technical ContextAI
Crafty Controller is a Python-based web wrapper/panel used to install, configure, and run Minecraft (and other game) server instances, exposing an authenticated web UI for uploading server files and importing existing server directories. The root cause is classified as CWE-35 (Path Traversal: '.../...//'), a variant of directory traversal where crafted relative-path sequences in filenames or archive/import paths defeat naive sanitization, allowing the upload handler to escape its intended storage directory. Because the application legitimately manages and executes server files on disk, writing attacker-controlled content outside the sandbox - for example into a scripts, config, or server-executable path the app later runs - converts a file-write primitive into remote code execution.
RemediationAI
Upgrade to the fixed Crafty Controller release referenced in the vendor GitLab work items (https://gitlab.com/crafty-controller/crafty-4/-/work_items/727 and https://gitlab.com/crafty-controller/crafty-4/-/work_items/740); a released patched version could not be independently confirmed from the provided data, so verify the exact fixed tag against the project's releases before deploying. Until patched, restrict access to the panel by placing it behind a VPN or IP allowlist and removing any internet exposure, since exploitation requires an authenticated session - tightening account access (strong unique credentials, disabling shared/low-privilege accounts, and limiting who can use server-import and admin file-upload) directly shrinks the attack surface, at the cost of reduced convenience for legitimate operators. Where feasible, run the Crafty Controller process under a dedicated low-privilege OS account with a read-only or tightly scoped filesystem to limit where a traversal write can land, and monitor upload/import activity for anomalous paths.
More in Crafty Controller
View allStored cross-site scripting (XSS) vulnerability in Crafty Controller that allows authenticated attackers to inject malic
A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticate
Path traversal in Crafty Controller game server management allows authenticated attackers to read/write files outside th
Crafty Controller Users API allows authenticated administrators with high privileges to modify other user accounts due t
Remote code execution in Crafty Controller's Backup Configuration feature results from insufficient path traversal valid
Same weakness CWE-35 – Path Traversal: '.../...//'
View allShare
External POC / Exploit Code
Leaving vuln.today