Unrated severityOSV Advisory· Published Dec 17, 2025· Updated Dec 17, 2025
Improper Neutralization of Special Elements Used in a Template Engine in Crafty Controller
CVE-2025-14700
Description
An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: 4.0.0-alpha.3, v4.0.0-alpha-3-hotfix.1, v4.0.0-alpha-3-hotfix.2, …
Patches
Vulnerability mechanics
References
1- gitlab.com/crafty-controller/crafty-4/-/issues/646mitreissue-trackingpermissions-required
News mentions
0No linked articles in our index yet.