CVE-2026-13716: Craftycontrol Crafty Controller

Critical severity, CVSS 9.1. EPSS: 0.8% chance of exploitation in the next 30 days.

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.

Affected products

• Craftycontrol Crafty Controller: from 4.4.0, before 4.10.8 (fixed in 4.10.8)

Published 2026-08-11. Last modified 2026-08-18.