Skip to content
OpenAdvisories

Package · Maven

org.craftercms:crafter-studio

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.3
    CVE-2025-6384 Public exploit

    Improper Control of Dynamically-Managed Code Resources in Crafter Studio

    Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass Sandbox restr…

    CrafterCMS CrafterCMS org.craftercms:crafter-studio Maven
  • High 7.6
    CVE-2021-23267

    Improper Control of Dynamically-Managed Code Resources in Crafter Studio

    Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker static methods.

    Crafter Software Crafter CMS org.craftercms:crafter-studio Maven
  • High 7.5
    CVE-2017-15684

    Path Traversal in Crafter CMS Crafter Studio

    Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view files from the operating system.

    org.craftercms:crafter-studio Maven
  • High 8.6
    CVE-2017-15685

    XML Injection in Crafter CMS Crafter Studio 3.0.1

    Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE). An unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.

    org.craftercms:crafter-studio Maven
  • High 8.8
    CVE-2018-19907

    OS Command Injection in craftercms:crafter-studio

    A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by Creating/Editing a template file (.ftl filetype) that triggers a call to freemarker.template.utility.Execute in the Fre…

    org.craftercms:crafter-studio Maven