Skip to content
OpenAdvisories

Package · Maven

org.craftercms:crafter-studio

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

10 results · Feed

  • High 7.3
    CVE-2025-6384 Public exploit

    Improper Control of Dynamically-Managed Code Resources in Crafter Studio

    Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass Sandbox restr…

    CrafterCMS CrafterCMS org.craftercms:crafter-studio Maven
  • Medium 6.4
    CVE-2022-40634 Public exploit

    Improper Control of Dynamically-Managed Code Resources in Crafter Studio

    Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI.

    Crafter Software Crafter CMS org.craftercms:crafter-studio Maven
  • High 7.6
    CVE-2021-23267

    Improper Control of Dynamically-Managed Code Resources in Crafter Studio

    Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker static methods.

    Crafter Software Crafter CMS org.craftercms:crafter-studio Maven
  • Critical 9.8
    CVE-2017-15681

    Path Traversal in Crafter CMS Crafter Studio

    In Crafter CMS Crafter Studio 3.0.1 a directory traversal vulnerability exists which allows unauthenticated attackers to overwrite files from the operating system which can lead to RCE.

    org.craftercms:crafter-studio Maven
  • High 7.5
    CVE-2017-15684

    Path Traversal in Crafter CMS Crafter Studio

    Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view files from the operating system.

    org.craftercms:crafter-studio Maven
  • High 8.6
    CVE-2017-15685

    XML Injection in Crafter CMS Crafter Studio 3.0.1

    Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE). An unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.

    org.craftercms:crafter-studio Maven
  • Medium 6.1
    CVE-2017-15686

    Cross-site scripting in Crafter CMS Crafter Studio

    Crafter CMS Crafter Studio 3.0.1 is affected by: Cross Site Scripting (XSS), which allows remote attackers to steal users’ cookies.

    org.craftercms:crafter-studio Maven
  • Medium 4.2
    CVE-2020-25803

    Authenticated attackers with developer privileges in Crafter Studio may execute OS commands via deep inspection of FreeMarker template exposed objects.

    Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker template exposed objects. This issue affects: Crafter Software Crafter CMS 3.0 versions…

    Crafter Software Crafter CMS org.craftercms:crafter-studio Maven
  • Medium 4.2
    CVE-2020-25802

    Authenticated attackers with developer privileges in Crafter Studio may execute OS commands via Groovy scripting.

    Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy scripting. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to 3.0.27; 3…

    Crafter Software Crafter CMS org.craftercms:crafter-studio Maven
  • High 8.8
    CVE-2018-19907

    OS Command Injection in craftercms:crafter-studio

    A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by Creating/Editing a template file (.ftl filetype) that triggers a call to freemarker.template.utility.Execute in the Fre…

    org.craftercms:crafter-studio Maven