PT-2025-51794 · Unknown · Crafty Controller

Published 2025-12-17 · Updated 2025-12-22 · CVE-2025-14700

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Crafty Controller version 4.6.1

Description An input neutralization issue exists within the Webhook Template component of Crafty Controller. This allows a remote, authenticated attacker to execute code on the system through Server Side Template Injection (SSTI). SSTI occurs when user-supplied input is not properly sanitized before being used in a server-side template engine, potentially leading to arbitrary code execution. The affected component is the Webhook Template.

Recommendations Restrict access to the Webhook Template component. Monitor logs for suspicious activity. Apply future patches as they become available.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2025-14700

Affected Products

Crafty Controller

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14700.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-14700 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14700 · Security Note
• https://t.me/cveNotify/146034 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2001114376737100217 · Twitter Post
• https://twitter.com/CveFindCom/status/2001104877510877326 · Twitter Post
• https://twitter.com/CVEnew/status/2001350838653194377 · Twitter Post
• https://twitter.com/offseq/status/2001103336636837923 · Twitter Post
• https://twitter.com/cracbot/status/2003057970083762398 · Twitter Post
• https://t.me/CVEtracker/40017 · Telegram Post
• https://twitter.com/TheHackerWire/status/2001104206275694981 · Twitter Post
• https://gitlab.com/crafty-controller/crafty-4/-/issues/646 · Note