Arcadia Technology vulnerabilities
We track 8 vulnerabilities in Arcadia Technology products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on October 16, 2026.
Latest Arcadia Technology vulnerabilities
- 9.6 Critical severity
Crafty Controller: Improper Encoding or Escaping of Output
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection
- 9.1 Critical severity
Crafty Controller: Path Traversal: '.../...//'
Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.
- 9.0 Critical severity
Crafty Controller: Authorization Bypass Through User-Controlled Key
An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation.
- 8.8 High severity
Crafty Controller: Improper Limitation of a Pathname to a Restricted Directory
An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.
- 8.8 High severity
Crafty Controller: Improper Limitation of a Pathname to a Restricted Directory
An input neutralization vulnerability in the Backup Configuration component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.
- 7.1 High severity
Crafty Controller: Improper Neutralization of Input During Web Page Generation
An input neutralization vulnerability in the Server MOTD component of Crafty Controller allows a remote, unauthenticated attacker to perform stored XSS via server MOTD modification.
- 9.9 Critical severity
Crafty Controller: Improper Neutralization of Special Elements Used in a Template Engine
An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection.
- 7.5 High severity
Crafty Controller: Improper Encoding or Escaping of Output
A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticated attacker to trigger a Denial of Service (DoS) condition via a modified host header