What’s Vulnerable › Vulnerabilities
CVE-2025-6384: Improper Control of Dynamically-Managed Code Resources in Crafter Studio
- Severity: critical (CVSS 9.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.0% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-06-19 · updated 2026-06-17
- Weakness: CWE-913
Description
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass Sandbox restrictions and obtain RCE (Remote Code Execution). This issue affects CrafterCMS: from 4.0.0 through 4.2.2.
Affected products
- CrafterCMS: from 4.0.0 before 4.3.0 — fixed in 4.3.0
How to fix
Upgrade to a fixed version: CrafterCMS 4.3.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-6384 or the next vulnerability affects your stack