CVE-2026-1770 Details
Description
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE (Remote Code Execution).
A remote code execution vulnerability has been identified in Crafter CMS's Crafter Studio, specifically in versions 4.0 prior to 4.5.0. This vulnerability arises from an improper control of dynamically-managed code resources, allowing authenticated developers to execute operating system commands by bypassing sandbox restrictions in the Groovy environment.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Feb 2, 2026CISA-ADP
Assessed Feb 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://docs.craftercms.org/current/security/advisory.html#cv-2026020201 | [email protected] | AdvisoryBundleVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-913 | Improper Control of Dynamically-Managed Code Resources | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Crafter CMS | >= 4.0, < 4.5.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 2, 2026 | New CVE Received | [email protected] |