Is CVE-2026-13716 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13716 being exploited in the wild.

How severe is CVE-2026-13716?

Critical severity, with a CVSS score of 9.1, published 11 August 2026.

Which products and versions are affected?

Crafty Controller Crafty Controller 4.10.7 and earlier.

Is there a fix for CVE-2026-13716?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-13716 attacked?

It is attacked over the network.

Am I affected by CVE-2026-13716?

Check whether you run Craftycontrol Crafty Controller. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13716: Crafty Controller path traversal in file upload

CVE-2026-13716 · Severity: critical · CVSS 9.1 · Published 2026-08-11

Crafty Controller is a web-based application for managing game servers. A path traversal vulnerability in its file upload feature allows authenticated users with basic permissions to upload files to arbitrary locations on the host system and execute arbitrary code with the privileges of the Crafty service account. An attacker could overwrite critical system files, deploy malware, or achieve remote code execution.

Technologies: Craftycontrol Crafty Controller. Vendors: Craftycontrol.

Quick answers

Is CVE-2026-13716 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13716 being exploited in the wild.
How severe is CVE-2026-13716?: Critical severity, with a CVSS score of 9.1, published 11 August 2026.
Which products and versions are affected?: Crafty Controller Crafty Controller 4.10.7 and earlier.
Is there a fix for CVE-2026-13716?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-13716 attacked?: It is attacked over the network.
Am I affected by CVE-2026-13716?: Check whether you run Craftycontrol Crafty Controller. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the file upload handler (`ApiFilesUploadHandler`) in `app/classes/web/routes/api/crafty/upload/index.py`. The handler accepts a user-supplied `fileName` request header and joins it directly with the upload directory without validating path traversal for the `import` and `background` upload types. While the `server_upload` type correctly validates traversal using `validate_traversal()`, the other branches skip this check. An authenticated attacker with the `SERVER_CREATION` permission (a normal non-superuser permission) or with `FILES` permission on a managed server can supply a `fileName` containing `../` sequences to escape the intended upload sandbox and write files to arbitrary paths. Additionally, the chunked-upload endpoint does not canonicalize or validate containment of the temporary chunk path, allowing an attacker to use absolute `fileId` values combined with traversal-bearing `chunkId` values to overwrite arbitrary files, including dynamically-rendered Tornado templates that lead to remote code execution.

Affected products

Crafty Controller Crafty Controller 4.10.7 and earlier

Timeline

2026-08-11: disclosed: CVE-2026-13716 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.