CVE-2026-13716: Crafty Controller Path Traversal RCE

CVE-2026-13716 Overview

CVE-2026-13716 is a path traversal vulnerability in Crafty Controller, a web-based Minecraft server management platform. The flaw resides in the server import and admin file upload functionality. Authenticated attackers can upload files to arbitrary paths writable by the Crafty Controller application. Successful exploitation results in remote code execution on the host system. The vulnerability is tracked under CWE-35: Path Traversal and carries a network-based attack vector. The issue is documented in the Crafty Controller GitLab project under work items 727 and 740.

Critical Impact
Authenticated attackers can write files to arbitrary filesystem paths accessible to Crafty Controller, enabling remote code execution and full compromise of managed server infrastructure.

Affected Products

Crafty Controller (crafty-4) - server import feature
Crafty Controller (crafty-4) - admin file upload feature
Refer to the Crafty Controller GitLab repository for affected release information

Discovery Timeline

2026-08-11 - CVE-2026-13716 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-13716

Vulnerability Analysis

Crafty Controller exposes two file-handling features that fail to sanitize user-supplied paths. The server import functionality accepts archive or file inputs used to instantiate Minecraft server instances. The admin file upload endpoint allows administrators to place files into the application's managed directories. Both paths accept directory traversal sequences that escape their intended base directories.

An authenticated attacker submits crafted filenames or archive entries containing traversal segments such as ../. The application resolves these paths without normalization or containment checks. Files land in directories outside the intended upload root, including locations that influence application startup, task scheduling, or web-served content. Writing an executable payload to a location that Crafty Controller or its host process later loads yields remote code execution.

The scope change reflected in the vulnerability's classification indicates that exploitation affects resources beyond the Crafty Controller process itself, extending to any file the application user account can modify on disk.

Root Cause

The root cause is missing or insufficient path canonicalization on user-controlled filename inputs [CWE-35]. The application concatenates attacker-controlled path components with a base directory rather than resolving the final path and verifying it remains within the allowed root. Archive extraction routines used during server import also fail to validate entry names against traversal sequences, a class of flaw commonly referred to as a Zip Slip weakness.

Attack Vector

Exploitation requires network access to the Crafty Controller web interface and valid authentication credentials for an account with import or admin upload privileges. The attacker submits an upload request with a filename or archive entry containing ../ sequences. The server writes the file to the traversed location. A subsequent request or scheduled task triggers execution of the planted payload. No user interaction is required beyond the attacker's authenticated session.

Refer to the vendor issues in GitLab Work Item #727 and GitLab Work Item #740 for implementation-level details.

// No verified proof-of-concept code is publicly available for this CVE.
// See the referenced GitLab work items for maintainer-provided technical details.

Detection Methods for CVE-2026-13716

Indicators of Compromise

Unexpected files appearing outside the Crafty Controller import and uploads directories, particularly in application code paths, configuration directories, or scheduled task locations.
Web access logs containing upload requests with filenames or multipart form fields containing .., ..%2f, or encoded path separators.
New or modified executable files, shell scripts, or Python modules owned by the Crafty Controller service account.
Child processes spawned by the Crafty Controller process that do not match normal Minecraft server or Java workloads.

Detection Strategies

Deploy web application firewall rules that inspect multipart form data and archive uploads for traversal sequences targeting Crafty Controller endpoints.
Enable file integrity monitoring on the Crafty Controller installation directory, virtual environment, and any parent directories writable by its service account.
Correlate authenticated API sessions with subsequent filesystem writes outside expected upload paths.

Monitoring Recommendations

Log and alert on all POST requests to server import and admin file upload endpoints, capturing full filename fields.
Monitor process execution telemetry for the Crafty Controller user account to identify unexpected interpreters, shells, or reverse-shell tooling.
Track outbound network connections initiated by the Crafty Controller host that deviate from baseline Minecraft server traffic.

How to Mitigate CVE-2026-13716

Immediate Actions Required

Upgrade Crafty Controller to a release that addresses GitLab Work Item #727 and GitLab Work Item #740.
Audit Crafty Controller user accounts and revoke import or admin privileges from any account that does not require them.
Review the Crafty Controller host for unauthorized files written outside intended upload directories since the vulnerable version was deployed.
Rotate credentials for all Crafty Controller accounts, especially administrator accounts, after patching.

Patch Information

The Crafty Controller maintainers track the fix in the project's GitLab work items 727 and 740. Consult the Crafty Controller GitLab project release notes for the specific version that includes remediation, and update all deployments to that release or later.

Workarounds

Restrict network exposure of the Crafty Controller web interface to trusted management networks or place it behind an authenticated reverse proxy.
Run Crafty Controller under a dedicated, least-privileged system account with write access limited to required directories.
Deploy the application inside a container or chroot with read-only mounts on directories that do not require write access at runtime.
Disable the admin file upload and server import features for non-essential administrator roles until patched.

bash

# Example: run Crafty Controller under a dedicated user with a restricted working set
useradd --system --home /opt/crafty --shell /usr/sbin/nologin crafty
chown -R crafty:crafty /opt/crafty
chmod -R go-w /opt/crafty
# Restrict web interface exposure to a management CIDR
iptables -A INPUT -p tcp --dport 8443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j DROP