High · 8.2 CVE-2026-0805 EUVD-2026-5043GHSA-m23h-283x-x3r6

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controller

Published Jan 30, 2026 · Updated Feb 2, 2026 · Assigned by GitLab

Vendor: Arcadia Technology Product: Crafty Controller

Description

An input neutralization vulnerability in the Backup Configuration component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.

Affected products

Vendor	Product	Affected	Fixed
Arcadia Technology	Crafty Controller	4.5.0 – < 4.8.0	4.8.0

References

GitLab Issue #650 issue-tracking permissions-required