Crafty Controller CVE-2026-18516

Exploitation requires a reachable Crafty Controller web interface and that the attacker-supplied value land in an HTTP header that the Audit Logs component records (HTTP header injection into audit entries); the stored payload only executes when a privileged user subsequently opens the Audit Logs view (UI:R / victim interaction by an administrator), which is the primary limiting factor. The planting step itself needs no authentication (PR:N), but realistic impact depends on the panel being exposed to the attacker's network path and on an admin actually viewing the poisoned log; the exact affected/fixed versions are not stated in the available data.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6) describes a network-reachable, low-complexity, unauthenticated stored XSS whose scope change and high triple-impact reflect the fact that script executes in the context of a privileged administrator viewing the Audit Logs. The elevated-impact signals are internally consistent for a stored XSS against a management console: an unauthenticated actor plants the payload via an HTTP header, and it detonates in the admin's authenticated browser session, plausibly enabling session/UI takeover of the server-management panel. However, several real-world risk signals are MISSING: there is no EPSS score, no CISA KEV listing, and no public exploit (POC) referenced in the provided data - so exploitation status is 'no public exploit identified at time of analysis.' The one reference is the vendor's own GitLab work item, indicating a coordinated/vendor-tracked disclosure rather than observed in-the-wild abuse. The high base score is therefore driven by the worst-case admin-context impact of XSS and the required victim interaction (UI:R), NOT by evidence of active exploitation; realistic priority is moderate - meaningful for anyone running internet-exposed Crafty Controller instances, but tempered by the niche deployment footprint and the need for an administrator to view the poisoned log entry. Note the C:H/I:H/A:H rating is aggressive for an XSS and should be read as 'potential full panel compromise via the admin session' rather than direct code/data impact; verify the concrete impact with the vendor work item.

An unauthenticated attacker sends an HTTP request to an internet-exposed Crafty Controller instance with a malicious script embedded in a request header (e.g., a header value logged by the audit subsystem). Because the Audit Logs component fails to properly escape output (CWE-116), the payload is stored and later rendered unescaped when an administrator opens the Audit Logs view, executing attacker-controlled JavaScript in the admin's authenticated session. No public exploit code is referenced in the provided data.