This vulnerability (CVE-2026-13716) involves a path traversal flaw (CWE-35) in Crafty Controller 4.4.0. An authenticated attacker can exploit the improper validation of file paths in the server import and admin file upload features to write files outside the intended directories. This can lead to remote code execution by placing malicious files in arbitrary locations permitted by the application. The CVSS v3.1 base score is 9.1, indicating a critical severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. The vulnerability affects exactly version 4.4.0 of the product. No official patch or remediation level has been published yet, and no known exploits in the wild have been reported.

Successful exploitation allows an authenticated attacker to upload files to arbitrary paths within the application's permitted file system scope, enabling remote code execution. This can compromise the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the admin and file upload functionalities to trusted users only and monitor for suspicious activity related to file uploads.