org.craftercms:crafter-studio (Maven) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Maven package org.craftercms:crafter-studio, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (10)

• CVE-2017-15681 — CVSS 9.8 (critical): In Crafter CMS Crafter Studio 3.0.1 a directory traversal vulnerability exists which allows unauthenticated attackers to overwrite files…
• CVE-2025-6384 — CVSS 9.1 (critical): Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to…
• CVE-2018-19907 — CVSS 8.8 (high): A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by…
• CVE-2017-15685 — CVSS 8.6 (high): Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE). An unauthenticated attacker is able to create a site with…
• CVE-2021-23267 — CVSS 7.6 (high): Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to…
• CVE-2017-15684 — CVSS 7.5 (high): Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view files from the…
• CVE-2022-40634 — CVSS 6.4 (medium): Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to…
• CVE-2017-15686 — CVSS 6.1 (medium): Crafter CMS Crafter Studio 3.0.1 is affected by: Cross Site Scripting (XSS), which allows remote attackers to steal users’ cookies.
• CVE-2020-25803 — CVSS 4.2 (medium): Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to…
• CVE-2020-25802 — CVSS 4.2 (medium): Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to…