by Kastro
Paper/Archive/CVE-2025-6384

CVE-2025-6384

CrafterCMS CrafterCMS — Improper Control of Dynamically-Managed Code Resources in Crafter Studio

EPSS 1.0%CVSS 9.1
critical.is priorityof 100
40
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 62.4.624 × 2012.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass Sandbox restrictions and obtain RCE (Remote Code Execution). This issue affects CrafterCMS: from 4.0.0 through 4.2.2.

Affected

ProductAffectedFixed inSource
CrafterCMS4.0.0 – < 4.3.04.3.0CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
crafter (CNA)7.3CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refdocs.craftercms.org/current/security/advisory.html#cv-2025061901