CVE-2026-0805: Path Traversal in Crafty Controller

The Path Traversal vulnerability in Crafty Controller presents a significant security risk. An attacker, after gaining authenticated access, can manipulate file paths to access sensitive files outside of the intended directory. This can lead to the disclosure of configuration files, credentials, or other critical data. More concerningly, successful exploitation could allow an attacker to execute arbitrary code on the system, effectively compromising the entire Crafty Controller instance and potentially leading to broader network compromise. The ability to execute code opens the door to data theft, system takeover, and denial-of-service attacks.

1. Reserved2026-01-09
2. Published2026-01-30
3. Modified2026-02-02
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-0805 is to upgrade Crafty Controller to version 4.8.0 or later, which contains the fix. If an immediate upgrade is not feasible, consider implementing temporary workarounds. Restrict access to the Backup Configuration component to only authorized users. Implement strict input validation on any user-supplied data used in file paths. Consider using a Web Application Firewall (WAF) with path traversal protection rules to block malicious requests. After upgrading, confirm the vulnerability is resolved by attempting to access files outside the intended directory and verifying that access is denied.