Crafty Controller EUVD-2026-55949

Exploitation requires a valid authenticated session on the Crafty Controller web panel (CVSS PR:L, so a low-privileged account suffices, not necessarily admin) and network reachability to that panel; no user interaction is needed. The attacker must be able to invoke the server-import or admin file-upload functionality and supply a path/filename containing traversal sequences that the handler fails to sanitize. Limiting factors: the panel must be network-reachable to the attacker and the attacker must already possess credentials - instances that are LAN-isolated, behind a VPN, or that restrict upload/import to trusted administrators materially reduce realistic exploitability. Successful RCE additionally depends on being able to write into a path the application will subsequently execute or load.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C, C:L/I:H/A:L, base 9.1) describes a network-reachable, low-complexity flaw needing only low-privileged authentication and no user interaction, with a scope change reflecting impact beyond the app's own security boundary - signals consistent with a serious file-write-to-RCE issue. That said, the vector's impact metrics (C:L/I:H/A:L) understate a full RCE outcome, which would normally warrant high confidentiality and availability impact; this internal inconsistency suggests the score was scoped conservatively and should be verified against the vendor work items. The practical gate is that an attacker must first hold valid credentials on the panel, so exposure depends heavily on how widely and how openly each instance is deployed; an internet-exposed Crafty panel with weak or shared credentials is a real and urgent priority, whereas an isolated LAN-only hobby instance is lower risk. With no KEV listing, no public PoC identified, and no EPSS figure provided, there is no evidence of active exploitation yet, but the low attack complexity and RCE payoff mean defenders should patch promptly rather than wait for exploitation signals.

An attacker who has obtained low-privileged credentials on an exposed Crafty Controller panel uses the server-import or admin file-upload feature with a crafted filename or archive containing traversal sequences to write a malicious file outside the intended directory. Placed into a location the application later executes or loads, the file yields remote code execution as the Crafty Controller service account. No public proof-of-concept has been identified, but the low attack complexity means a working exploit would be straightforward to develop once credentials are in hand.