CVE-2025-6384 HIGH

CVE-2025-6384: Improper Control of Dynamically-Managed Code Resources in Crafter Studio

Vendor Craftercms
Product CrafterCMS
Weakness CWE-913
Published June 19, 2025
Last update June 23, 2025
View on NVD All CVEs

CVSS base score

7.3/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

01Description

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass Sandbox restrictions and obtain RCE (Remote Code Execution). This issue affects CrafterCMS: from 4.0.0 through 4.2.2.

Key dates

02Disclosure timeline

June 19, 2025 CVE published
June 23, 2025 Record updated