CVE-2025-6384

Improper Control of Dynamically-Managed Code Resources in Crafter Studio

State: Published
Severity: 7.3 High
Published: Jun 19, 2025
Updated: Jun 23, 2025
Reserved: Jun 19, 2025

Description

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.

By inserting malicious Groovy elements, an attacker may bypass Sandbox restrictions and obtain RCE (Remote Code Execution).

This issue affects CrafterCMS: from 4.0.0 through 4.2.2.

Scores

CVSS	Score	Vector	Source
4.0	7.3 High	CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H	crafter

Weaknesses

CWE-913 Improper Control of Dynamically-Managed Code Resources

Affected Products

Product	Versions
CrafterCMSCrafterCMS	4.0.0 to before 4.3.0Affected

References

https://docs.craftercms.org/current/security/advisory.html#cv-2025061901

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.