CVE-2026-1770

Improper Control of Dynamically-Managed Code Resources in Crafter Studio

State: Published
Severity: 4.5 Medium
Published: Feb 2, 2026
Updated: Feb 2, 2026
Reserved: Feb 2, 2026

Description

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE (Remote Code Execution).

Scores

CVSS	Score	Vector	Source
4.0	4.5 Medium	CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/AU:N	crafter

Weaknesses

CWE-913 Improper Control of Dynamically-Managed Code Resources

Affected Products

Product	Versions
CrafterCMSCrafterCMS	4.0.0 to before 4.5.0Affected

References

https://docs.craftercms.org/current/security/advisory.html#cv-2026020201

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.