Executive brief
Crafty Controller is a web-based application for managing game servers. A path traversal vulnerability in its file upload feature allows authenticated users with basic permissions to upload files to arbitrary locations on the host system and execute arbitrary code with the privileges of the Crafty service account. An attacker could overwrite critical system files, deploy malware, or achieve remote code execution.
Technical details
The vulnerability exists in the file upload handler (`ApiFilesUploadHandler`) in `app/classes/web/routes/api/crafty/upload/index.py`. The handler accepts a user-supplied `fileName` request header and joins it directly with the upload directory without validating path traversal for the `import` and `background` upload types. While the `server_upload` type correctly validates traversal using `validate_traversal()`, the other branches skip this check. An authenticated attacker with the `SERVER_CREATION` permission (a normal non-superuser permission) or with `FILES` permission on a managed server can supply a `fileName` containing `../` sequences to escape the intended upload sandbox and write files to arbitrary paths. Additionally, the chunked-upload endpoint does not canonicalize or validate containment of the temporary chunk path, allowing an attacker to use absolute `fileId` values combined with traversal-bearing `chunkId` values to overwrite arbitrary files, including dynamically-rendered Tornado templates that lead to remote code execution.
Affected products
- Crafty Controller Crafty Controller 4.10.7 and earlier
Timeline
- 2026-08-11: disclosed: CVE-2026-13716 published