Executive Summary
A critical path traversal vulnerability tracked as CVE-2026-13716 has been disclosed in Crafty Controller, a popular open-source Minecraft game server management panel. With a CVSS score of 9.1, the flaw allows a remote, authenticated attacker to upload files to arbitrary paths on the host system and achieve remote code execution by leveraging two attack surfaces: the server import feature and the admin file upload endpoint.
CVSS Score: 9.1 (Critical)
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-13716 |
| CVSS Score | 9.1 (Critical) |
| Type | Path Traversal / Arbitrary File Write / RCE |
| Attack Vector | Network |
| Privileges Required | Low (authenticated user) |
| User Interaction | None |
| Attack Surfaces | Server import endpoint, admin file upload |
Technical Details
Crafty Controller fails to properly sanitize user-supplied file paths during two operations:
- Server Import — when importing a server archive, the application does not restrict extraction paths, allowing a
zip slipor equivalent path traversal attack. - Admin File Upload — the admin panel's file upload feature does not canonicalize or restrict the destination path, enabling an attacker to write files anywhere the Crafty process has permission.
Attack Chain
1. Attacker authenticates to Crafty Controller (any user account)
2. Crafts a malicious archive or upload request with ../../../ path traversal sequences
3. File is written to an attacker-controlled path outside the intended directory
4. If written to a web-accessible or executable location, attacker triggers execution
5. Remote code execution achieved under Crafty Controller's process privilegesImpact Matrix
| Impact | Description |
|---|---|
| Remote Code Execution | Write and execute malicious scripts on the server |
| Configuration Tampering | Overwrite server configs, SSH authorized_keys |
| Credential Theft | Write files to harvest credentials from running services |
| Persistence | Drop backdoors or cron jobs for persistent access |
| Lateral Movement | Pivot to other services co-hosted on the same host |
Affected Versions
Crafty Controller versions prior to the patch release are affected. Consult the official Crafty Controller GitHub repository and changelog for the specific fixed version tag.
Remediation
Step 1: Update Crafty Controller
Update to the latest patched release immediately via the Crafty Controller update mechanism or by pulling the latest image if running via Docker:
# If running via Docker
docker pull registry.craftypanel.com/crafty-4/crafty-web:latest
docker compose pull && docker compose up -d
# Check running version
docker exec crafty cat /crafty/crafty-4/app/config/version.jsonStep 2: Restrict User Permissions
Until patching is confirmed, limit which users can access file upload and server import features. Revoke upload permissions from untrusted accounts:
- Log in to Crafty Controller as admin
- Navigate to Settings > User Management
- Review and restrict file upload and server import permissions
Step 3: Audit Existing Installations for Compromise
# Check for recently modified files outside Crafty's expected directories
find / -newer /opt/crafty/crafty-4 -type f 2>/dev/null | grep -v /proc | grep -v /sys
# Look for unexpected cron jobs
crontab -l
ls -la /etc/cron*
# Check for new user accounts or SSH key additions
cat /etc/passwd | grep -v nologin | grep -v false
ls -la ~/.ssh/authorized_keysStep 4: Network-Level Mitigations
- Place Crafty Controller behind a VPN or restrict access to trusted IP ranges
- Do not expose the Crafty web panel directly to the public internet
- Enforce firewall rules to limit outbound connections from the Crafty host
Detection
| Indicator | Description |
|---|---|
POST requests with ../ sequences in filenames | Path traversal exploitation attempts |
| Files appearing outside Crafty's data directory | Successful path traversal |
New cron jobs or modified /etc/crontab | Persistence mechanism deployed |
New SSH keys in authorized_keys | Backdoor access established |
| Unexpected outbound connections from server host | Post-exploitation activity |
Post-Remediation Checklist
- Confirm Crafty Controller updated to patched version
- Audit all user accounts — remove unnecessary privileges
- Scan filesystem for unauthorized files written outside Crafty directories
- Review server logs for suspicious upload activity
- Rotate all credentials accessible from the Crafty host
- Enable host-based intrusion detection if not already in place
- Consider Crafty-specific AppArmor or seccomp profile to limit file system access