Improper Control of Dynamically-Managed Code Resources in Crafter Studio
Priority LOW 34CWE-913Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass Sandbox restrictions and obtain RCE (Remote Code Execution). This issue affects CrafterCMS: from 4.0.0 through 4.2.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00987 62nd percentileScored 2026-11-07
Fix Fixed CrafterCMS (CrafterCMS): 4.3.0org.craftercms:crafter-studio (Maven): 4.3.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Crafter Software | CrafterCMS | 4.0.0 to before 4.3.0 | 4.3.0 | Patch available | CNA |
| — | org.craftercms:crafter-studio (Maven) | 4.0.0 to before 4.3.0 | 4.3.0 | Patch available | GHSA-5644-3vgq-2ph5 |
- CrafterCMS VendorCrafter Software Affected 4.0.0 to before 4.3.0 Fixed in 4.3.0 Patch available CNA
- org.craftercms:crafter-studio (Maven) Vendor— Affected 4.0.0 to before 4.3.0 Fixed in 4.3.0 Patch available GHSA-5644-3vgq-2ph5
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:craftercms:craftercms:*:*:*:*:*:*:*:* | 4.0.0 to before 4.3.0 | Vulnerable | Crafter Software |
- cpe:2.3:a:craftercms:craftercms:*:*:*:*:*:*:*:* Versions 4.0.0 to before 4.3.0 Vulnerable ·Crafter Software
Remediation
- Fix · CNA CrafterCMS (CrafterCMS) Fixed in 4.3.0
- Fix · GHSA-5644-3vgq-2ph5 org.craftercms:crafter-studio (Maven) Fixed in 4.3.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-6384
- 2026-10-03 Alias added: GHSA-5644-3vgq-2ph5
References
More Crafter Software Craftercms vulnerabilities
- TI-2023-16371 CraftCMS stored XSS in Quick Post widget error message CVSS 3.1MEDIUM 4.8
- TI-2025-00416 Transmission of Private Resources into a New Sphere in Crafter Engine CVSS 4.0MEDIUM 6.9
- TI-2023-03829 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafter Engine CVSS 3.1HIGH 7.4
Sources
- CVE-2025-6384 · CVE Program
- CVE-2025-6384 · NVD
- FIRST EPSS
- GHSA-5644-3vgq-2ph5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences