Improper Control of Dynamically-Managed Code Resources in Crafter Studio
Priority LOW 21CWE-913Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE (Remote Code Execution).
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00472 41st percentileScored 2026-11-07
Fix Fixed CrafterCMS (CrafterCMS): 4.5.0org.craftercms:craftercms (Maven): 4.5.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Crafter Software | CrafterCMS | 4.0.0 to before 4.5.0 | 4.5.0 | Patch available | CNA |
| — | org.craftercms:craftercms (Maven) | 4.0.0 to before 4.5.0 | 4.5.0 | Patch available | GHSA-gj28-gw7w-3pxc |
- CrafterCMS VendorCrafter Software Affected 4.0.0 to before 4.5.0 Fixed in 4.5.0 Patch available CNA
- org.craftercms:craftercms (Maven) Vendor— Affected 4.0.0 to before 4.5.0 Fixed in 4.5.0 Patch available GHSA-gj28-gw7w-3pxc
Remediation
- Fix · CNA CrafterCMS (CrafterCMS) Fixed in 4.5.0
- Fix · GHSA-gj28-gw7w-3pxc org.craftercms:craftercms (Maven) Fixed in 4.5.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-1770
- 2026-10-03 Alias added: GHSA-gj28-gw7w-3pxc
References
More Crafter Software vulnerabilities
- TI-2023-16371 CraftCMS stored XSS in Quick Post widget error message CVSS 3.1MEDIUM 4.8
- TI-2017-11458 In Crafter CMS Crafter Studio 3.0.1 a directory traversal vulnerability exists which… CVSS 3.1CRITICAL 9.8
- TI-2021-06004 Exposure of resource to wrong sphere in Crafter CMS CVSS 3.1CRITICAL 9.1
- TI-2018-14105 A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. CVSS 3.0HIGH 8.8
- TI-2017-11462 Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE). CVSS 3.1HIGH 8.6
- TI-2021-06007 Improper Control of Dynamically-Managed Code Resources in Crafter Studio CVSS 3.1HIGH 8.8
Sources
- CVE-2026-1770 · CVE Program
- CVE-2026-1770 · NVD
- FIRST EPSS
- GHSA-gj28-gw7w-3pxc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences