PT-2026-5380 · Unknown · Crafty Controller

Published 2026-01-30 · Updated 2026-01-31 · CVE-2026-0805

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Crafty Controller (affected versions not specified)

Description An input neutralization flaw exists in the Backup Configuration component of Crafty Controller. This issue allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal. The flaw could allow unauthorized file access. The vulnerability is identified as CVE-2026-0805.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-0805

Affected Products

Crafty Controller

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0805.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-0805 · Security Note
• https://osv.dev/vulnerability/CVE-2026-0805 · Vendor Advisory
• https://gitlab.com/crafty-controller/crafty-4/-/issues/650 · Note
• https://twitter.com/TheHackerWire/status/2017136425888862622 · Twitter Post
• https://t.me/cveNotify/150368 · Telegram Post
• https://twitter.com/pulsepatchio/status/2017609435305463994 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2017167782513655843 · Twitter Post
• https://twitter.com/CVEnew/status/2017132853767942654 · Twitter Post