CVE-2026-0963: Path Traversal in Crafty Controller

The impact of CVE-2026-0963 is severe due to the potential for both file tampering and remote code execution. An attacker exploiting this vulnerability could read sensitive configuration files, modify critical system files, or even upload and execute malicious code. Successful exploitation could lead to complete system compromise, data exfiltration, and denial of service. The ability to execute arbitrary code elevates the risk significantly, allowing attackers to establish persistent access or pivot to other systems within the network. This vulnerability shares similarities with other path traversal exploits where attackers leverage improperly validated user input to access files outside of the intended directory.

1. Reserved2026-01-14
2. Published2026-01-30
3. Modified2026-02-02
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-0963 is to upgrade Crafty Controller to version 4.8.0 or later, which contains the fix. If immediate upgrading is not feasible, consider implementing temporary workarounds. Restrict access to the File Operations API Endpoint to only authorized users and implement strict input validation to prevent path traversal attempts. Consider deploying a Web Application Firewall (WAF) with rules to block requests containing suspicious path characters (e.g., '..', '/', '\'). Regularly monitor system logs for unusual file access patterns. After upgrading, confirm the fix by attempting a path traversal attack on the File Operations API Endpoint and verifying that access is denied.