External risk intelligence

Crafty Controller Path Traversal Leading to Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-13716

Crafty Controller is a server management application often deployed as a web interface to manage game servers. These portals are commonly configured to be internet-facing to allow remote administrative access and user management, placing the file upload and server import functionality in a position where it is reachable from the public internet.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical security vulnerability in Crafty Controller, a web-based server management application. The flaw allows authenticated users to upload files to unintended locations, potentially leading to unauthorized code execution on the server. This could impact the confidentiality, integrity, and availability of services managed by the application.

Allows file uploads to unintended server locations.
Could enable unauthorized code execution on servers.
Confirm relevance and exposure for business continuity.

Attack Path

How an attacker could exploit the issue

An attacker with existing access to Crafty Controller could exploit this vulnerability by uploading files to unintended locations on the server. This could allow them to execute arbitrary code, leading to a critical compromise of the system.

Requires authenticated access to the application.
An attacker uploads a specially crafted file.
Remote code execution and system compromise.

Live Threat

Current exploitation, exposure, and threat context

An authenticated attacker could exploit this vulnerability to upload arbitrary files to the Crafty Controller application. This could lead to unauthorized code execution on the server, impacting the application's services and potentially any system data it manages.

Server files and application control.
Arbitrary file upload via import/admin functions.
Remote code execution and service disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Crafty Controller installations, a server management application often exposed externally for remote administration. Responsibility for remediation typically lies with the application owner or platform team managing the Crafty Controller instance, in coordination with network/security teams for exposure review and vendor management if direct vendor support is required. The immediate priority is to confirm where Crafty Controller is deployed, ascertain its external reachability and business criticality, identify the accountable owner, and then develop a risk-based remediation plan.

Application or platform team owns the issue.
Verify external reachability and business criticality.
Plan remediation based on identified risks.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Crafty Controller?

Crafty Controller is a server management application designed to simplify the administration of game servers. It provides a centralized web-based dashboard that allows administrators to handle server configurations, user access, and file management tasks without needing direct command-line interaction.

What does path traversal mean for CVE-2026-13716?

Path traversal (CWE-35) is a weakness where software fails to properly sanitize file paths. In this vulnerability, it allows an attacker to manipulate file input paths to bypass intended directory restrictions, ultimately enabling them to place files in unauthorized locations on the underlying server system.

How is this vulnerability triggered?

An attacker triggers this flaw by using the application's server import or administrative file upload functions to place a specially crafted file. Notably, this requires an existing authenticated session; the vulnerability cannot be triggered by unauthenticated users or through features that do not involve file uploads.

Why should I care about this if my server is internal?

According to Halo Surface Signal, Crafty Controller is often internet-facing to facilitate remote management, which significantly increases risk. While internal deployments may be less reachable to broad external threats, the vulnerability still poses a critical risk if an attacker gains any level of authenticated access to your network or the application itself.

What should I do first to address CVE-2026-13716?

Begin by inventorying your environment to locate all Crafty Controller instances. Once identified, evaluate whether those instances are accessible from the internet. Prioritize these findings with your security or platform team to define a remediation timeline based on the business criticality of the managed servers.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.