An input neutralization flaw in Crafty Controller's Backup Configuration component permits a remote authenticated attacker to execute arbitrary code by exploiting path traversal to tamper with files, leading to remote code execution and file integrity compromise.

The vulnerability affects Arcadia Technology, LLC’s Crafty Controller application; the CVE does not specify which releases are impacted, so all versions running the vulnerable Backup Configuration component are potentially susceptible.

The CVSS score of 8.2 signals high severity, but the EPSS score of less than 1% indicates a low likelihood of exploitation at present; however, because the flaw requires authentication, users with privileged access pose a significant risk, and the vulnerability is not currently listed in the CISA KEV catalog.