CVE-2026-1770

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1770", "assignerOrgId": "4ff2b028-869f-4b00-a7b2-05997f6f14fd", "state": "PUBLISHED", "assignerShortName": "crafter", "dateReserved": "2026-02-02T16:14:38.698Z", "datePublished": "2026-02-02T16:16:01.466Z", "dateUpdated": "2026-02-02T16:38:59.620Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "Studio", "platforms": ["Linux", "MacOS", "x86", "ARM", "64 bit"], "product": "CrafterCMS", "vendor": "CrafterCMS", "versions": [{"lessThan": "4.5.0", "status": "affected", "version": "4.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Matei \"Mal\" Badanoiu"}], "datePublic": "2026-02-02T16:01:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE (Remote Code Execution).</p>"}], "value": "Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE (Remote Code Execution)."}], "impacts": [{"capecId": "CAPEC-253", "descriptions": [{"lang": "en", "value": "CAPEC-253 Remote Code Inclusion"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NO", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 4.5, "baseSeverity": "MEDIUM", "exploitMaturity": "UNREPORTED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/AU:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-913", "description": "CWE-913 Improper Control of Dynamically-Managed Code Resources", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4ff2b028-869f-4b00-a7b2-05997f6f14fd", "shortName": "crafter", "dateUpdated": "2026-02-02T16:16:01.466Z"}, "references": [{"url": "https://docs.craftercms.org/current/security/advisory.html#cv-2026020201"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Enable the Groovy Sandbox whitelist mode:&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://craftercms.com/docs/current/reference/modules/studio.html#enabling-the-sandbox-whitelist\">https://craftercms.com/docs/current/reference/modules/studio.html#enabling-the-sandbox-whitelist</a>"}], "value": "Enable the Groovy Sandbox whitelist mode:\u00a0 https://craftercms.com/docs/current/reference/modules/studio.html#enabling-the-sandbox-whitelist"}], "source": {"discovery": "EXTERNAL"}, "title": "Improper Control of Dynamically-Managed Code Resources in Crafter Studio", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-02T16:38:34.866456Z", "id": "CVE-2026-1770", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-02T16:38:59.620Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1770", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-02T16:38:34.866456Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-02T16:38:52.452Z"}}], "cna": {"title": "Improper Control of Dynamically-Managed Code Resources in Crafter Studio", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Matei \"Mal\" Badanoiu"}], "impacts": [{"capecId": "CAPEC-253", "descriptions": [{"lang": "en", "value": "CAPEC-253 Remote Code Inclusion"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.5, "Automatable": "NO", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/AU:N", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "CrafterCMS", "product": "CrafterCMS", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.5.0", "versionType": "semver"}], "platforms": ["Linux", "MacOS", "x86", "ARM", "64 bit"], "packageName": "Studio", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Enable the Groovy Sandbox whitelist mode:\u00a0 https://craftercms.com/docs/current/reference/modules/studio.html#enabling-the-sandbox-whitelist", "supportingMedia": [{"type": "text/html", "value": "Enable the Groovy Sandbox whitelist mode:&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://craftercms.com/docs/current/reference/modules/studio.html#enabling-the-sandbox-whitelist\">https://craftercms.com/docs/current/reference/modules/studio.html#enabling-the-sandbox-whitelist</a>", "base64": false}]}], "datePublic": "2026-02-02T16:01:00.000Z", "references": [{"url": "https://docs.craftercms.org/current/security/advisory.html#cv-2026020201"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE (Remote Code Execution).", "supportingMedia": [{"type": "text/html", "value": "<p>Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE (Remote Code Execution).</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-913", "description": "CWE-913 Improper Control of Dynamically-Managed Code Resources"}]}], "providerMetadata": {"orgId": "4ff2b028-869f-4b00-a7b2-05997f6f14fd", "shortName": "crafter", "dateUpdated": "2026-02-02T16:16:01.466Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1770", "state": "PUBLISHED", "dateUpdated": "2026-02-02T16:38:59.620Z", "dateReserved": "2026-02-02T16:14:38.698Z", "assignerOrgId": "4ff2b028-869f-4b00-a7b2-05997f6f14fd", "datePublished": "2026-02-02T16:16:01.466Z", "assignerShortName": "crafter"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "Studio", "platforms": ["Linux", "MacOS", "x86", "ARM", "64 bit"], "product": "CrafterCMS", "vendor": "CrafterCMS", "versions": [{"lessThan": "4.5.0", "status": "affected", "version": "4.0.0", "versionType": "semver"}]}], "source": "security@craftersoftware.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE (Remote Code Execution)."}, {"lang": "es", "value": "Vulnerabilidad de Control Inadecuado de Recursos de C\u00f3digo Gestionados Din\u00e1micamente en Crafter Studio de Crafter CMS permite a desarrolladores autenticados ejecutar comandos del sistema operativo a trav\u00e9s de una Omisi\u00f3n de Sandbox de Groovy. Al insertar elementos Groovy maliciosos, un atacante puede omitir las restricciones de la sandbox y obtener RCE (Ejecuci\u00f3n Remota de C\u00f3digo)."}], "id": "CVE-2026-1770", "lastModified": "2026-06-17T10:16:29.443", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NO", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@craftersoftware.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1770", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-02T16:38:34.866456Z", "version": "2.0.3"}}]}, "published": "2026-02-02T17:16:17.643", "references": [{"source": "security@craftersoftware.com", "url": "https://docs.craftercms.org/current/security/advisory.html#cv-2026020201"}], "sourceIdentifier": "security@craftersoftware.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-913"}], "source": "security@craftersoftware.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T00:38:20.463936+00:00", "value": {"mitigation_remediation": ["Enable Groovy Sandbox whitelist mode as documented in the CrafterCMS Studio configuration guide.", "Restrict developer and plugin installation privileges to a small, trusted group and enforce least\u2011privilege access controls.", "Implement monitoring and logging for Groovy script changes and execute\u2011time events to detect anomalies."], "summary": {"action": "Enable Whitelist", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "CrafterCMS, specifically the CrafterCMS Studio module. No explicit version range is listed, so all releases containing the affected studio component are potentially impacted.", "description_and_impact": "An authentication\u2011controlled flaw in Crafter Studio allows the injection of malicious Groovy code that bypasses the sandbox, enabling the attacker to run arbitrary operating\u2011system commands. The weakness maps to CWE\u2011913, Improper Control of Dynamically\u2011Managed Code Resources. As a result, a compromised developer account can compromise the entire system, exposing all confidential data and potentially disrupting availability.", "risk_and_exploitability": "The CVSS score of 4.5 describes moderate severity, and the EPSS score of less than 1% indicates a low probability of widespread exploitation. The flaw does not appear on the KEV catalog. Exploitation requires valid developer credentials and the ability to insert Groovy elements, so the vector is limited to authenticated insiders or attackers who have gained such access. If successful, the attacker would gain full control over the underlying operating system."}}}}, "created": "2026-02-04T12:18:14.977242+00:00", "updated": "2026-04-18T00:45:32.239403+00:00", "vendors": ["craftercms", "craftercms$PRODUCT$crafter_cms", "craftercms$PRODUCT$craftercms"]}