CVE-2022-40635: Craftercms Crafter CMS

High severity, CVSS 7.2. EPSS: 1.6% chance of exploitation in the next 30 days.

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.

Affected products

• Craftercms Crafter CMS: from 3.1.0, before 3.1.23 (fixed in 3.1.23)

Published 2022-09-13. Last modified 2026-06-17.