Critical · 9.9 CVE-2026-0963 EUVD-2026-5044GHSA-8phm-9c2m-9hpq

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controller

Published Jan 30, 2026 · Updated Feb 2, 2026 · Assigned by GitLab

Vendor: Arcadia Technology Product: Crafty Controller

Description

An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.

Affected products

Vendor	Product	Affected	Fixed
Arcadia Technology	Crafty Controller	4.7.0 – < 4.8.0	4.8.0

References

GitLab Issue #660 issue-tracking permissions-required