CVE-2026-0963

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0963", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-01-14T20:14:16.821Z", "datePublished": "2026-01-30T06:04:05.503Z", "dateUpdated": "2026-02-02T16:33:26.381Z"}, "containers": {"cna": {"title": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controller", "descriptions": [{"lang": "en", "value": "An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal."}], "affected": [{"vendor": "Arcadia Technology, LLC", "product": "Crafty Controller", "versions": [{"version": "4.7.0", "status": "affected", "lessThan": "4.8.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "cweId": "CWE-22", "type": "CWE"}]}], "references": [{"url": "https://gitlab.com/crafty-controller/crafty-4/-/issues/660", "name": "GitLab Issue #660", "tags": ["issue-tracking", "permissions-required"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "LOW", "baseScore": 9.9, "baseSeverity": "CRITICAL"}}], "solutions": [{"lang": "en", "value": "Upgrade to version 4.8.0"}], "credits": [{"lang": "en", "value": "Thank you to [Rozza / rchar](https://gitlab.com/rchar) on GitLab for reporting this issue.", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-01-30T06:04:05.503Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-30T14:24:06.892805Z", "id": "CVE-2026-0963", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-02T16:33:26.381Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0963", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-30T14:24:06.892805Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-30T14:24:10.232Z"}}], "cna": {"title": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controller", "credits": [{"lang": "en", "type": "finder", "value": "Thank you to [Rozza / rchar](https://gitlab.com/rchar) on GitLab for reporting this issue."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Arcadia Technology, LLC", "product": "Crafty Controller", "versions": [{"status": "affected", "version": "4.7.0", "lessThan": "4.8.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to version 4.8.0"}], "references": [{"url": "https://gitlab.com/crafty-controller/crafty-4/-/issues/660", "name": "GitLab Issue #660", "tags": ["issue-tracking", "permissions-required"]}], "descriptions": [{"lang": "en", "value": "An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-01-30T06:04:05.503Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0963", "state": "PUBLISHED", "dateUpdated": "2026-02-02T16:33:26.381Z", "dateReserved": "2026-01-14T20:14:16.821Z", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "datePublished": "2026-01-30T06:04:05.503Z", "assignerShortName": "GitLab"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Crafty Controller", "vendor": "Arcadia Technology, LLC", "versions": [{"lessThan": "4.8.0", "status": "affected", "version": "4.7.0", "versionType": "semver"}]}], "source": "cve@gitlab.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:craftycontrol:crafty_controller:4.7.0:*:*:*:*:*:*:*", "matchCriteriaId": "E37C1841-65A3-4553-82DA-8E1B7051DF1E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal."}, {"lang": "es", "value": "Una vulnerabilidad de neutralizaci\u00f3n de entrada en el componente de punto final de la API de operaciones de archivo de Crafty Controller permite a un atacante remoto y autenticado realizar manipulaci\u00f3n de archivos y ejecuci\u00f3n remota de c\u00f3digo a trav\u00e9s de salto de ruta."}], "id": "CVE-2026-0963", "lastModified": "2026-06-17T10:11:41.883", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "cve@gitlab.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0963", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-30T14:24:06.892805Z", "version": "2.0.3"}}]}, "published": "2026-01-30T07:16:15.173", "references": [{"source": "cve@gitlab.com", "tags": ["Broken Link"], "url": "https://gitlab.com/crafty-controller/crafty-4/-/issues/660"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "cve@gitlab.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T01:13:35.450786+00:00", "value": {"mitigation_remediation": ["Update Crafty Controller to version 4.8.0 or later, as released by Arcadia Technology.", "Restrict access to the File Operations API endpoint to trusted users and networks, ensuring only authorized accounts can invoke it.", "Implement input validation on file path parameters, rejecting any attempts to traverse directories (for example by disallowing \"..\" sequences or absolute path references)."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Arcadia Technology, LLC\u2019s Crafty Controller version 4.7.0 is affected. Users running this version or any earlier release that has not applied the vendor\u2011published fix are vulnerable. No other affected versions were disclosed in the current data.", "description_and_impact": "The vulnerability is an input neutralization flaw in the File Operations API endpoint of Crafty Controller that permits a remote, authenticated attacker to manipulate file paths. The flaw allows the attacker to perform path traversal, leading to file tampering and potentially remote code execution. This is a classic directory traversal weakness identified as CWE\u201122 and provides an attacker with the ability to read, write, or execute files beyond the intended directory.", "risk_and_exploitability": "This flaw carries a CVSS score of 9.9, indicating critical severity. The EPSS score is reported as less than 1\u202f%, suggesting a low probability of exploitation at present, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector requires a remote authenticated connection to the File Operations API endpoint. Once authenticated, an attacker can supply crafted file path input that traverses outside the intended directory, enabling tampering with system files and execution of arbitrary code on the host."}}}}, "created": "2026-02-02T09:27:48.585632+00:00", "updated": "2026-04-18T01:15:05.994813+00:00", "vendors": ["arcadia_technology", "arcadia_technology$PRODUCT$crafty_controller"]}