High severityNVD Advisory· Published Jun 19, 2025· Updated Jun 23, 2025

Improper Control of Dynamically-Managed Code Resources in Crafter Studio

CVE-2025-6384

Description

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.

By inserting malicious Groovy elements, an attacker may bypass Sandbox restrictions and obtain RCE (Remote Code Execution).

This issue affects CrafterCMS: from 4.0.0 through 4.2.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.craftercms:crafter-studioMaven	>= 4.0.0, < 4.3.0	4.3.0

Affected products

ghsa-coords
pkg:maven/org.craftercms/crafter-studio
Range: >= 4.0.0, < 4.3.0
Craftercms/Craftercmsv5
Range: 4.0.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-5644-3vgq-2ph5ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-6384ghsaADVISORY
docs.craftercms.org/current/security/advisory.htmlghsaWEB
github.com/craftercms/studio/commit/471bbad07cf1f3b420529a020c1409ad57d48a4eghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000