Description
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.
By inserting malicious Groovy elements, an attacker may bypass Sandbox restrictions and obtain RCE (Remote Code Execution).
This issue affects CrafterCMS: from 4.0.0 through 4.2.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CrafterCMS | CrafterCMS | 4.0.0 – < 4.3.0 | 4.3.0 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
maestro-ant/CrafterCMS-CVE-2025-6384 ★ 0 · Sep 26, 2025
PoC exploit for an authenticated RCE in CrafterCMS via Groovy sandbox bypass (CVE-2025-6384)
-
mbadanoiu/CVE-2025-6384 ★ 0 · Aug 8, 2025
CVE-2025-6384: Groovy Sandbox Bypass 2 in CrafterCMS
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.craftercms:crafter-studio | >= 4.0.0, < 4.3.0 | 4.3.0 | GHSA-5644-3vgq-2ph5 |