CVE-2026-1770 MEDIUM

CVE-2026-1770: Improper Control of Dynamically-Managed Code Resources in Crafter Studio

Vendor Craftercms
Product CrafterCMS
Weakness CWE-913
Published February 2, 2026
Last update February 2, 2026
View on NVD All CVEs

CVSS base score

4.5/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/AU:N

What the vulnerability does

01Description

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE (Remote Code Execution).

Key dates

02Disclosure timeline

February 2, 2026 CVE published
February 2, 2026 Record updated