CVE-2026-0963: Craftycontrol Crafty Controller

High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days.

An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.

Affected products

• Craftycontrol Crafty Controller: version 4.7.0 only

Published 2026-01-30. Last modified 2026-06-17.