CVE-2020-25802: Craftercms Studio

High severity, CVSS 7.2. EPSS: 1.1% chance of exploitation in the next 30 days.

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy scripting. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to 3.0.27; 3.1 versions prior to 3.1.7.

Affected products

• Craftercms Studio: from 3.0.0, before 3.0.27 (fixed in 3.0.27); from 3.1.0, before 3.1.7 (fixed in 3.1.7)

Published 2020-10-06. Last modified 2026-06-17.